CVE-2024-22190

Katalog CVE

CVSS 7.8 · High EPSS 0,32%

Kerentanan Untrusted Search Path pada gitpython project gitpython. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.

Rincian

Terbit di NVD

11 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitpython-developers/GitPython/pull/1792 patch · advisory vendor
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx advisory vendor
• https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f patch