{"id":"CVE-2022-24439","aliases":["DEBIAN-CVE-2022-24439","DLA-3502-1","DLA-3939-1","EUVD-2022-0114","GHSA-hcpj-qp55-gfph","MGASA-2023-0001","OESA-2023-1529","PYSEC-2022-42992","RHSA-2023:5931","UBUNTU-CVE-2022-24439","USN-5968-1","openSUSE-SU-2024:12596-1","openSUSE-SU-2024:13510-1","openSUSE-SU-2025:14858-1"],"status":"published","title":"Remote Code Execution (RCE)","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.06137,"percentile":0.93502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-94"],"published":"2022-12-06T05:15:00Z","modified":"2026-11-03T08:03:50Z","exploits":[{"source":"pocgithub","id":"muhammadhendro/CVE-2022-24439","title":"muhammadhendro/CVE-2022-24439","date":"2024-10-16","url":"https://github.com/muhammadhendro/CVE-2022-24439"},{"source":"pocgithub","id":"Makkkiiii/GitPython-Exploit-CVE-2022-24439","title":"Makkkiiii/GitPython-Exploit-CVE-2022-24439","date":"2025-07-12","url":"https://github.com/Makkkiiii/GitPython-Exploit-CVE-2022-24439"}],"fixes":[{"ecosystem":"PyPI","package":"gitpython","fixed_in":["3.1.30"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-git","fixed_in":["3.1.30-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-git","fixed_in":["3.1.30-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-git","fixed_in":["3.1.30-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-gitpython","fixed_in":["3.1.30-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","fixed_in":["0.3.2~RC1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","fixed_in":["1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","fixed_in":["2.1.8-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","fixed_in":["3.0.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","fixed_in":["3.1.24-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python3-bandit","fixed_in":["1.7.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-GitPython","fixed_in":["3.1.44-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.29"},{"fixed":"3.1.30"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-1+deb10u1"}]}],"versions":["2.1.11-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-1+deb11u1"}]}],"versions":["3.1.14-1"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-1.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-1.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-1.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm1"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm1"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm1"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm1"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm1"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm1"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm1"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm1"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python3-bandit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.44-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gitpython-developers","product":"gitpython"},{"vendor":"gitpython_project","product":"gitpython"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858","tags":["x_transferred","Exploit","Third Party Advisory","web","evidence","article","report"]},{"url":"https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249","tags":["x_transferred","Broken Link","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202311-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24439","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py#L1249","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/issues/1515","tags":["web","report"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.30","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/2625ed9fc074091c531c27ffcba7902771130261","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2022-42992.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hcpj-qp55-gfph","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24439.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24439","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0001.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31242","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1529","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40267","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/","tags":["article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/","tags":["article","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5931","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite/index","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2151583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243296","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5931.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220503.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220621.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3874","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24439","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24439","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46648","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN16765254/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-47318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-47318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47318","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230731.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31047","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/may/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36053","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/jul/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://go.dev/issue/63417","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40267","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40267","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr76-5cm5-w9cj","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2022-24439","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5968-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24439","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BL425OEFL7RRAGOKGQULOL6EAUGVFV3O/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24439","title":"Remote Code Execution (RCE)","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-12T01:49:10.008Z","modified":"2025-11-03T21:46:05.215Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-0114","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-12T01:49:10Z","modified":"2025-11-03T21:46:05Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-hcpj-qp55-gfph","title":"GitPython vulnerable to Remote Code Execution due to improper user input validation","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T06:30:17Z","modified":"2025-11-04T16:40:12Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2022-24439","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T05:15:11.42Z","modified":"2026-06-17T04:31:50.803Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"CVE-2022-24439","title":"Remote Code Execution (RCE)","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T05:15:11.42Z","modified":"2026-10-28T02:30:34.253357821Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24439","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T05:15:11.42Z","modified":"2026-11-03T08:03:50.693928204Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-hcpj-qp55-gfph","title":"GitPython vulnerable to Remote Code Execution due to improper user input validation","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T06:30:17Z","modified":"2025-11-04T16:49:34.739763Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"OESA-2023-1529","title":"python-GitPython security update","description":"GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.\n\nSecurity Fix(es):\n\nAll versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.(CVE-2022-24439)\n\nGitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.(CVE-2023-40267)","status":"published","published":"2023-08-26T11:05:59Z","modified":"2026-08-18T01:17:48.258931963Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:5931","title":"Red Hat Security Advisory: Satellite 6.13.5 Async Security Update","status":"published","published":"2024-10-02T11:22:53Z","modified":"2026-10-20T10:01:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2022-24439","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T05:15:00Z","modified":"2026-05-22T17:16:55.433681786Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3502-1","title":"python-git - security update","status":"published","published":"2023-07-25T00:00:00Z","modified":"2026-03-09T01:19:09.558649Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3939-1","title":"python-git - security update","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-03-09T01:20:17.429769Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0001","title":"Updated python-gitpython packages fix security vulnerability","description":"Remote Code Execution (RCE) due to improper user input validation, which\nmakes it possible to inject a maliciously crafted remote URL into the\nclone command. Exploiting this vulnerability is possible because the\nlibrary makes external calls to git without sufficient sanitization of\ninput arguments. This is only relevant when enabling the ext transport\nprotocol (CVE-2022-24439)\n","status":"published","published":"2023-01-13T17:37:09Z","modified":"2026-04-16T04:40:34.365946102Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12596-1","title":"python310-GitPython-3.1.30.1672298042.141cd65-1.1 on GA media","description":"These are all security issues fixed in the python310-GitPython-3.1.30.1672298042.141cd65-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:23.829311Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:13510-1","title":"python3-bandit-1.7.6-1.1 on GA media","description":"These are all security issues fixed in the python3-bandit-1.7.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:16:30.02232Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14858-1","title":"python311-GitPython-3.1.44-1.1 on GA media","description":"These are all security issues fixed in the python311-GitPython-3.1.44-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-06T00:00:00Z","modified":"2026-02-04T03:12:59.951262Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"PYSEC-2022-42992","description":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.","status":"published","published":"2022-12-06T05:15:00Z","modified":"2026-06-10T17:01:18.875610166Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"USN-5968-1","title":"python-git vulnerability","description":"It was discovered that GitPython did not properly sanitize user inputs for\nremote URLs in the clone command. By injecting a maliciously crafted\nremote URL, an attacker could possibly use this issue to execute arbitrary\ncommands on the host.\n","status":"published","published":"2023-03-22T15:02:15Z","modified":"2026-06-29T13:50:50.122934856Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}