GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has not yet been addressed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7b78427a7d advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0322 advisory.

  - GitPython: Blind local file inclusion (CVE-2023-41040)

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0190 advisory.

  - GitPython: Blind local file inclusion (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7851 advisory.

  - foreman: World readable file containing secrets (CVE-2023-4886)

  - actionpack: Possible XSS via User Supplied Values to redirect_to (CVE-2023-28362)

  - GitPython: Blind local file inclusion (CVE-2023-41040)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

  - urllib3: Request body not stripped after redirect from 303 status changes request method to GET     (CVE-2023-45803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory.

  - golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

  - GitPython: Blind local file inclusion (CVE-2023-41040)

  - axios: exposure of confidential data stored in cookies (CVE-2023-45857)

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

  - python-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)

  - python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)

  - golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

  - jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

  - aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)

  - python-aiohttp: http request smuggling (CVE-2024-23829)

  - Django: denial-of-service in ``intcomma`` template filter (CVE-2024-24680)

  - python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()     (CVE-2024-27351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0215 advisory.

  - GitPython: Blind local file inclusion (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3589 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0271-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0259-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195811	RHEL 7 : gitpython (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194559	Fedora 40 : GitPython (2023-7b78427a7d)	Nessus	Fedora Local Security Checks	medium
194438	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0322)	Nessus	Red Hat Local Security Checks	medium
194409	RHEL 8 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0190)	Nessus	Red Hat Local Security Checks	medium
194386	RHEL 8 : Satellite 6.14.1 Async Security Update (Moderate) (RHSA-2023:7851)	Nessus	Red Hat Local Security Checks	high
193086	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)	Nessus	Red Hat Local Security Checks	high
189084	RHEL 9 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0215)	Nessus	Red Hat Local Security Checks	medium
182377	Debian DLA-3589-1 : python-git - LTS security update	Nessus	Debian Local Security Checks	medium
181920	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0271-1)	Nessus	SuSE Local Security Checks	medium
181859	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0259-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-41040

medium

Tenable Plugins

critical

medium

medium

medium

high

high

medium

medium

medium

medium