Uploaded image for project: '1D Redmine '
  1. 1D Redmine
  2. REDMINE1D-313

[RM-8297] Update GitPython version

    XMLWordPrintable

    Details

    • Type: Task
    • Status: Done (View Workflow)
    • Priority: Normal
    • Resolution: Done
    • Labels:
      None

      Description

      Created on 2023-09-15 08:42:35 by Ali Allaoui. % Done: 100

      GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

        Attachments

          Activity

            People

            • Assignee:
              r2j.migrate Redmine-Jira Migtation
              Reporter:
              r2j.migrate Redmine-Jira Migtation
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: