PyPI/gitpython CVE-2023-41040: medium 4, EPSS 1.09%
GitPython blind local file inclusion
Action: Upgrade gitpython to 3.1.37 or later.
pip install gitpython==3.1.37Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.37 | - |
Fixed versions
| 3.1.37 |
Sources
- osv: GHSA-cwvm-v4w8-q58c
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
- https://nvd.nist.gov/vuln/detail/CVE-2023-41040
- https://github.com/gitpython-developers/GitPython/pull/1672
- https://github.com/gitpython-developers/GitPython/commit/74e55ee4544867e1bd976b7df5a45869ee397b0b
- https://github.com/gitpython-developers/GitPython/commit/e98f57b81f792f0f5e18d33ee658ae395f9aa3c4
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-165.yaml
- https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html
- https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html
CVE-2023-41040 · published · modified · JSON