tocsin

PyPI/gitpython CVE-2022-24439: unknown, EPSS 6.14%

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone

Action: Upgrade gitpython to 3.1.30 or later.

pip install gitpython==3.1.30

Affected

introducedfixedlast affected
03.1.30-

Fixed versions

3.1.30

Sources

CVE-2022-24439 · published · modified · JSON