CVE-2022-24439: gitpython project gitpython +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-24439

CVSS 9.8 · Critical EPSS 5,9%

Kerentanan Improper Input Validation pada gitpython project gitpython, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Rincian

Terbit di NVD: 6 Desember 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
EPSS (30 hari): 5,9% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
gitpython project	gitpython	Semua versi sebelum 3.1.30
fedoraproject	fedora	Versi 36
fedoraproject	fedora	Versi 37
fedoraproject	fedora	Versi 38
debian	debian linux	Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.debian.org/debian-lts-announce/2023/07/msg00024.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UE... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM... mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202311-01 advisory pihak ketiga
https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858 exploit · advisory pihak ketiga
https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.... broken link
https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.