UBUNTU-CVE-2022-24439

See a problem?

Source

https://ubuntu.com/security/CVE-2022-24439

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-24439.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-24439

Related

Published

2022-12-06T05:15:00Z

Modified

2024-10-15T14:09:48Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

References

Affected packages

Ubuntu:Pro:14.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.2~RC1-3ubuntu0.1~esm1

Affected versions

0.*

0.3.2~RC1-2

0.3.2~RC1-3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm1",
            "binary_name": "python-git"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1

Affected versions

1.*

1.0.1+git137-gc8b8379-1

1.0.1+git137-gc8b8379-2

1.0.1+git137-gc8b8379-2.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
            "binary_name": "python-git"
        },
        {
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
            "binary_name": "python-git-doc"
        },
        {
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
            "binary_name": "python3-git"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.8-1ubuntu0.1~esm1

Affected versions

2.*

2.1.5-1

2.1.6-1

2.1.7-1

2.1.8-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.1.8-1ubuntu0.1~esm1",
            "binary_name": "python-git"
        },
        {
            "binary_version": "2.1.8-1ubuntu0.1~esm1",
            "binary_name": "python-git-doc"
        },
        {
            "binary_version": "2.1.8-1ubuntu0.1~esm1",
            "binary_name": "python3-git"
        }
    ]
}

Ubuntu:20.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.11-1

3.*

3.0.4-1

3.0.5-1

3.0.7-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.7-1ubuntu0.1~esm1

Affected versions

2.*

2.1.11-1

3.*

3.0.4-1

3.0.5-1

3.0.7-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.0.7-1ubuntu0.1~esm1",
            "binary_name": "python-git-doc"
        },
        {
            "binary_version": "3.0.7-1ubuntu0.1~esm1",
            "binary_name": "python3-git"
        }
    ]
}

Ubuntu:22.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.14-1

3.1.23-1

3.1.24-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:22.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.24-1ubuntu0.1~esm1

Affected versions

3.*

3.1.14-1

3.1.23-1

3.1.24-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.24-1ubuntu0.1~esm1",
            "binary_name": "python-git-doc"
        },
        {
            "binary_version": "3.1.24-1ubuntu0.1~esm1",
            "binary_name": "python3-git"
        }
    ]
}

Ubuntu:24.10 / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.37-3

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / python-git

Package

Name: python-git
Purl: pkg:deb/ubuntu/python-git?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.30-1

3.1.37-1

3.1.37-3

Ecosystem specific

{
    "ubuntu_priority": "medium"
}