Debian dla-4872 : python-git-doc - security update

critical Nessus Plugin ID 374599

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4872 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4872-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias October 31, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : python-git Version : 3.1.30-1+deb12u3 CVE ID : CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244 CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325 CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620 CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624 CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219 CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675 CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679 CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689 CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858 CVE-2026-110859 CVE-2026-110860 CVE-2026-114145 Debian Bug : 1135349 1135350 1143454 1143602 1144344 1144929

Multiple security vulnerabilities were discovered in python-git (GitPython), a Python library used to interact with git repositories.
These issues could result in arbitrary command execution, path traversal with arbitrary file read or write, git config injection, leaking of secrets through environment variable expansion or denial of service (ReDoS).

CVE-2026-42215

Unsafe options passed as underscored keyword arguments were not blocked, which could lead to command execution.

CVE-2026-42284

Unsafe options were not checked after splitting multi_options with shlex, which could lead to command execution.

CVE-2026-44243

When manipulating references, access to files outside the repository was not prevented, allowing arbitrary file access.

CVE-2026-44244

The config writer did not reject control characters in config values, allowing config injection.

CVE-2026-67322

Environment variables were expanded in clone URLs, which could leak secrets to a remote host.

CVE-2026-67323

Unsafe options (--exec, --upload-pack, ...) were not guarded in the archive, fetch, pull, push, ls-remote, blame and revision APIs, which could lead to command execution.

CVE-2026-67324

Abbreviated long options bypassed the unsafe option checks, leading to command execution.

CVE-2026-67325

Joined short options bypassed the unsafe option checks, leading to command execution.

CVE-2026-67326

Config section names were not validated before writing, allowing config injection.

CVE-2026-69097

Config section names containing an unquoted closing bracket could inject arbitrary settings into .git/config.

CVE-2026-73619

The --add-file, --add-virtual-file (archive) and --bundle-uri (clone) options were missing from the unsafe option lists, which could lead to command execution or arbitrary file access.

CVE-2026-73620

Unsafe options in IndexFile.checkout() (--prefix) and TagReference.create() (-F/--file) were not blocked, which could write to or read from arbitrary filesystem paths.

CVE-2026-73621

Unsafe output options were not rejected in Commit.count, which could write to arbitrary filesystem paths.

CVE-2026-73622

Environment variables were expanded in remote and submodule URLs, which could leak secrets to a remote host.

CVE-2026-73623

The unsafe --template option was not rejected when cloning, which could read from arbitrary filesystem paths.

CVE-2026-73624

Unsafe output options were not guarded in diff operations, which could write to arbitrary filesystem paths.

CVE-2026-73625

The values of split short options were not validated, which could bypass the unsafe option checks in clone, remote, revision, blame and archive operations.

CVE-2026-76217

The --pathspec-from-file options were not guarded in IndexFile.remove, Head.checkout and HEAD.reset, which could read from arbitrary filesystem paths.

CVE-2026-76218

Unsafe git init options (--template, --separate-git-dir) were not guarded in Repo.init, which could read from or write to arbitrary filesystem paths.

CVE-2026-76219

The --index-output option was not guarded in read-tree calls made by from_tree, merge_tree and reset, which could write to an arbitrary path.

CVE-2026-76220

The value joined to one-character options was not checked when split_single_char_options is false, which could bypass the unsafe option checks.

CVE-2026-76221

Config option names containing characters that could inject arbitrary settings when writing the config were not rejected.

CVE-2026-76222

Submodule names read from .gitmodules were not validated before filesystem operations, allowing path traversal outside the repository.

CVE-2026-78675

Include directives in .gitmodules were processed, which could read arbitrary files.

CVE-2026-78676

Multiline config values were not preserved when writing, which could inject new options into the config.

CVE-2026-78677

The --separate-git-dir option was not blocked in Repo.clone() and Repo.clone_from(), which could write repository metadata to an arbitrary path.

CVE-2026-78678, CVE-2026-78679

File-reading options were not blocked in blame, diff and tag APIs, which could read arbitrary files.

CVE-2026-87817

Repository discovery did not prefer the .git entry nor validate candidate git directories, diverging from git's behaviour.

CVE-2026-87818

The --no-index option was not treated as an unsafe diff option, which allowed diffing arbitrary filesystem paths.

CVE-2026-87819

Actor identities were parsed with regular expressions, allowing quadratic backtracking (ReDoS) on malformed identities.

CVE-2026-100689

Submodule checkout paths that resolve outside the repository or through a symbolic link were not rejected in Submodule.update, unlike in add and move.

CVE-2026-110855

Environment variables were expanded in the separate_git_dir path when cloning, so repository metadata could be written to an unexpected location.

CVE-2026-110856

Actor identities and dates in commit authors, committers and taggers were parsed with backtracking regular expressions, allowing excessive CPU use (ReDoS) on malformed metadata.

CVE-2026-110857

The unsafe option and protocol checks were incomplete in Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which omitted guards already used by sibling APIs.

CVE-2026-110858

Option-shaped remote names were not rejected in Remote.update(), which git forwards to fetch --multiple without an option terminator, allowing a leading-dash name to change the requested operation.

CVE-2026-110859

The positional reference passed by Head.checkout() was not validated against the unsafe-option policy, so reference names originating in a cloned repository could bypass it.

CVE-2026-110860

Submodule checkout, move and metadata paths that traverse intermediate symbolic links were not rejected before performing filesystem operations.

CVE-2026-114145

GitPython validated a submodule's '.git' path only after cloning into it, which could lead to remote code execution.

For Debian 12 bookworm, these problems have been fixed in version 3.1.30-1+deb12u3.

We recommend that you upgrade your python-git packages.

For the detailed security status of python-git please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/python-git

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the python-git-doc packages.

Plugin Details

Severity: Critical

ID: 374599

File Name: debian_DLA-4872.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 10/31/2026

Updated: 10/31/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.58

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-42284

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-78676

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:python-git-doc, p-cpe:/a:debian:debian_linux:python3-git

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/31/2026

Vulnerability Publication Date: 4/25/2026

Reference Information

CVE: CVE-2026-100689, CVE-2026-110855, CVE-2026-110856, CVE-2026-110857, CVE-2026-110858, CVE-2026-110859, CVE-2026-110860, CVE-2026-114145, CVE-2026-42215, CVE-2026-42284, CVE-2026-44243, CVE-2026-44244, CVE-2026-67322, CVE-2026-67323, CVE-2026-67324, CVE-2026-67325, CVE-2026-67326, CVE-2026-69097, CVE-2026-73619, CVE-2026-73620, CVE-2026-73621, CVE-2026-73622, CVE-2026-73623, CVE-2026-73624, CVE-2026-73625, CVE-2026-76217, CVE-2026-76218, CVE-2026-76219, CVE-2026-76220, CVE-2026-76221, CVE-2026-76222, CVE-2026-78675, CVE-2026-78676, CVE-2026-78677, CVE-2026-78678, CVE-2026-78679, CVE-2026-87817, CVE-2026-87818, CVE-2026-87819

Detections

Analytics

Debian dla-4872 : python-git-doc - security update

critical Nessus Plugin ID 374599

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information