CVE-2022-24439 in gitpython

Riassunto

di MITRE • 06/12/2022

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsabile: Snyk
• Prenotare: 24/02/2022
• Divulgazione: 06/12/2022
• Moderazione: accettato
• Voce: VDB-214816
• CPE: pronto
• CWE: CWE-20 (confermato)
• CVSS: 9.8 (NVD)
• EPSS: 0.05378
• KEV: no
• Attività: molto basso
• Settore: Finance, Education, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-24439
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-24439
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-24439/