GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8303-1 advisory.

    Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git     references. An attacker could possibly use this issue to cause files outside the .git directory to be     accessed, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-41040)

    Wes Ring discovered that GitPython did not properly block certain unsafe Git options when they were     provided as Python keyword arguments. An attacker could possibly use this issue to cause arbitrary command     execution. (CVE-2026-42215)

    It was discovered that GitPython did not properly validate clone options before processing them. An     attacker could possibly use this issue to inject unsafe Git configuration, leading to arbitrary command     execution through Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04     LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)

    It was discovered that GitPython did not properly validate reference paths during reference operations. An     attacker could possibly use this issue to write, overwrite, move, or delete files outside the repository.
    (CVE-2026-44243)

    Dan Aridor discovered that GitPython did not properly validate configuration values before writing them to     Git configuration files. An attacker could possibly use this issue to inject unsafe Git configuration,     leading to arbitrary command execution through Git hooks. (CVE-2026-44244)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0160 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-41040:
    GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has been addressed in version     3.1.37.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git
    references, GitPython reads files from the `.git` directory, in some places the name of the file being
    read is provided by the user, GitPython doesn't check if this file is located outside the `.git`
    directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is
    present in https://github.com/gitpython-
    developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That
    code joins the base directory with a user given string without checking if the final path is located
    outside the base directory. This vulnerability cannot be used to read the contents of files but could in
    theory be used to trigger a denial of service for the program. This issue has been addressed in version
    3.1.37. (CVE-2023-41040)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has been addressed in version     3.1.37. (CVE-2023-41040)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3939 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3939-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 29, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 3.1.14-1+deb11u1     CVE ID         : CVE-2022-24439 CVE-2023-40267 CVE-2023-41040     Debian Bug     : 1027163 1043503

    GitPython provides object model access to a Git repository.

    CVE-2022-24439, CVE-2023-40267 (follow-up)

        Remote Code Execution (RCE) is possible due to improper user input         validation, which makes it possible to inject a maliciously crafted         remote URL into the clone command. Exploiting this vulnerability is         possible because the library makes external calls to git without         sufficient sanitization of input arguments.

    CVE-2023-41040

        GitPython reads files from the `.git` directory, in some places the         name of the file being read is provided by the user, GitPython         doesn't check if this file is located outside the `.git` directory.
        This allows an attacker to make GitPython read any file from the         system.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.14-1+deb11u1.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS



    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7b78427a7d advisory.

    Automatic update for GitPython-3.1.40-1.fc40.

    ##### **Changelog**

    ```
    * Thu Nov  9 2023 Carl George <carlwgeorge@fedoraproject.org> - 3.1.40-1
    - Update to version 3.1.40, resolves rhbz#2221770
    - Fix CVE-2023-41040, resolves rhbz#2248698

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0322 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * python3-gitpython/python39-gitpython: Blind local file inclusion (CVE-2023-41040)

    * python3-twisted/python39-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional changes:
    * python3-dynaconf/python39-dynaconf has been updated to 3.1.12-2
    * python3-gitpython/python39-gitpython has been updated to 3.1.40
    * python3-twisted/python39-twisted has been updated to 23.10.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0190 advisory.

    GitPython is a python library used to interact with Git repositories.

    Security Fix(es):

    * Blind local file inclusion (CVE-2023-41040)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7851 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security fix(es):

    * rubygem-actionpack: actionpack: Possible XSS via User Supplied Values to redirect_to     [rhn_satellite_6.14] (CVE-2023-28362)

    * foreman: World readable file containing secrets [rhn_satellite_6.14] (CVE-2023-4886)

    * python-urllib3: urllib3: Request body not stripped after redirect from 303 status changes request method     to GET [rhn_satellite_6-default] (CVE-2023-45803 )

    *  python-gitpython: GitPython: Blind local file inclusion [rhn_satellite_6-default] (CVE-2023-41040)

    This update fixes the following bugs:

    2250342 - REX job finished with exit code 0 but the script failed on client side due to no space.
    2250343 - Selinux denials are reported after following Chapter 13. Managing Custom File Type Content     chapter step by step     2250344 - Long running postgres threads during content-export     2250345 - Upgrade django-import-export package to at least 3.1.0     2250349 - After upstream repo switched to zst compression, Satellite 6.12.5.1 unable to sync     2250350 - Slow generate applicability for Hosts with multiple modulestreams installed     2250352 - Recalculate button for Errata is not available on Satellite 6.13/ Satellite 6.14 if no errata is     present     2250351 - Actions::ForemanLeapp::PreupgradeJob fails with null value in column preupgrade_report_id     violates not-null constraint when run with non-admin user     2251799 - REX Template for 'convert2rhel analyze' command     2254085 - Getting '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0] ERROR while trying     to upgrade Satellite 6.13 to 6.14     2254080 - satellite-convert2rhel-toolkit rpm v1.0.0 in 6.14.z

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django: denial-of-service in 'intcomma' template filter (CVE-2024-24680)
    * automation-controller: aiohttp: http request smuggling (CVE-2024-23829)
    * automation-controller: aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * automation-controller: Jinja2: HTML attribute injection when passing user input as keys to xmlattr     filter (CVE-2024-22195)
    * automation-controller: cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)
    * automation-controller: aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * automation-controller: Twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)
    * automation-controller: axios: exposure of confidential data stored in cookies (CVE-2023-45857)
    * automation-controller: GitPython: Blind local file inclusion (CVE-2023-41040)
    * python3-aiohttp/python39-aiohttp: http request smuggling (CVE-2024-23829)
    * python3-aiohttp/python39-aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python3-django/python39-django: Potential regular expression denial-of-service in     django.utils.text.Truncator.words() (CVE-2024-27351)
    * receptor: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads     (CVE-2024-1394)
    * receptor: golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed bug where schedule prompted variables and survey answers were reset on edit when changing one of     the basic form fields (AAP-20967)
    * Fixed the update execution environment image to no longer fail jobs that use the previous image     (AAP-21733)
    * Removed string validation using comparisons of English literals for comparison, replacing validation     with error/op codes as a universal approach to validation and comparison (AAP-21721)
    * Fixed dispatcher to appropriately terminate child processes when dispatcher terminates (AAP-21049)
    * Fixed upgrade from Ansible Tower 3.8.6 to AAP 2.4 to no longer fail upon database schema migration     (AAP-19738)
    * automation-controller has been updated to 4.5.5

    Updates and fixes for receptor:
    * Fixes a receptor dialing issue where the connection attempt is timed out too aggressively (AAP-21838,     AAP-21828)
    * receptor has been updated to 1.4.5

    Additional fixes:
    * ansible-core has been updated to 2.15.10
    * ansible-runner has been updated to 2.3.6
    * python3-aiohttp/python39-aiohttp has been updated to 3.9.3
    * python3-django/python39-django has been updated  4.2.11
    * python3-pulpcore/python39-pulpcore has been updated 3.28.24

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0215 advisory.

    GitPython is a python library used to interact with Git repositories.

    Security Fix(es):

    * Blind local file inclusion (CVE-2023-41040)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3589 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3589-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     September 29, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 2.1.11-1+deb10u2     CVE ID         : CVE-2023-41040

    Santos Gallegos discovered a blind local file inclusion in python-git, a     Python library to interact with Git repositories, which could lead to     denial of service or potentially information disclosure.

    In order to resolve some git references, python-git reads files from the     .git directory but, due to improper location check, an attacker can     pass a file located outside this directory thereby making python-git     read arbitrary file on the system.

    It remains unclear whether the attacker can gain access to actual file     content, but denial of service can be achieved by passing a large or     infinite file such as /dev/random.

    For Debian 10 buster, this problem has been fixed in version     2.1.11-1+deb10u2.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0271-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0259-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
317096	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GitPython vulnerabilities (USN-8303-1)	Nessus	Ubuntu Local Security Checks	high
239696	TencentOS Server 4: python-GitPython (TSSA-2025:0160)	Nessus	Tencent Local Security Checks	medium
421602	SCA: security update for GitPython (GHSA-cwvm-v4w8-q58c)	Tenable Cloud Security	SCA Checks	medium
421602	SCA: security update for GitPython (GHSA-cwvm-v4w8-q58c)	Tenable Self-Hosted Container Security	SCA Checks	medium
226127	Linux Distros Unpatched Vulnerability : CVE-2023-41040	Nessus	Misc.	medium
209877	Debian dla-3939 : python-git-doc - security update	Nessus	Debian Local Security Checks	critical
194559	Fedora 40 : GitPython (2023-7b78427a7d)	Nessus	Fedora Local Security Checks	medium
194438	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0322)	Nessus	Red Hat Local Security Checks	medium
194409	RHEL 8 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0190)	Nessus	Red Hat Local Security Checks	medium
194386	RHEL 8 : Satellite 6.14.1 Async Security Update (Moderate) (RHSA-2023:7851)	Nessus	Red Hat Local Security Checks	critical
193086	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)	Nessus	Red Hat Local Security Checks	critical
189084	RHEL 9 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0215)	Nessus	Red Hat Local Security Checks	medium
408123	Alpine: multiple py3-gitpython packages: security update to 3.1.37-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
408123	Alpine: multiple py3-gitpython packages: security update to 3.1.37-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
401382	Alpine: multiple py3-gitpython packages: security update to 3.1.35-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
401382	Alpine: multiple py3-gitpython packages: security update to 3.1.35-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
182377	Debian dla-3589 : python-git - security update	Nessus	Debian Local Security Checks	medium
181920	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0271-1)	Nessus	SuSE Local Security Checks	medium
181859	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0259-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-41040

medium

Tenable Plugins

high

medium

medium

medium

medium

critical

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium