{"id":"CVE-2023-41040","aliases":["ALPINE-CVE-2023-41040","CLSA-2025-1759191117","DEBIAN-CVE-2023-41040","DLA-3589-1","DLA-3939-1","EUVD-2023-0087","GHSA-cwvm-v4w8-q58c","MGASA-2026-0372","OESA-2023-1628","PYSEC-2023-165","RHSA-2023:7851","RHSA-2024:0190","RHSA-2024:0215","RHSA-2024:0322","RHSA-2024:1640","UBUNTU-CVE-2023-41040","USN-8303-1","openSUSE-SU-2023:0259-1","openSUSE-SU-2023:0271-1","openSUSE-SU-2024:13207-1","openSUSE-SU-2026:11419-1"],"status":"published","title":"GitPython blind local file inclusion","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01093,"percentile":0.65905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-08-30T20:09:36Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"PyPI","package":"gitpython","fixed_in":["3.1.37","3.1.35"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-gitpython","fixed_in":["3.1.37-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"gitpython","fixed_in":["3.1.31.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-git","fixed_in":["3.1.30-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-git","fixed_in":["3.1.36-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-git","fixed_in":["3.1.36-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"python-git","fixed_in":["2.1.11-1+deb10u2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-GitPython","fixed_in":["3.1.32-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-GitPython","fixed_in":["3.1.32-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-GitPython","fixed_in":["3.1.32-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-GitPython","fixed_in":["3.1.32-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-GitPython","fixed_in":["3.1.32-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"GitPython","fixed_in":["0:3.1.14-2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-GitPython","fixed_in":["0:3.1.14-2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"GitPython","fixed_in":["0:3.1.14-2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-GitPython","fixed_in":["0:3.1.14-2.el9ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","fixed_in":["0.3.2~RC1-3ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","fixed_in":["1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","fixed_in":["2.1.8-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","fixed_in":["3.0.7-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","fixed_in":["3.1.24-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"python-GitPython","fixed_in":["3.1.12.1610074031.f653af66-bp155.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-GitPython","fixed_in":["3.1.12.1610074031.f653af66-bp155.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"python-GitPython","fixed_in":["3.1.12.1610074031.f653af66-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-GitPython","fixed_in":["3.1.12.1610074031.f653af66-bp154.2.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.31"},{"fixed":"3.1.31.post1+tuxcare"}]}],"versions":["3.1.31"]},{"source":"osv","ecosystem":"Debian:12","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1+deb12u2"}]}],"versions":["3.1.30-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.36-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.36-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-1+deb10u2"}]}],"versions":["2.1.11-1","2.1.11-1+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-1+deb11u1"}]}],"versions":["3.1.14-1"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.50-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.32-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.35"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-installer-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-installer-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"pulpcore-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python3-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python3-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"rubygem-smart_proxy_remote_execution_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-2.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"pulpcore-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python3-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python3-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actioncable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionmailbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actiontext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activejob","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_leapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.2-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.2-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-smart_proxy_remote_execution_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-2.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-convert2rhel-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-twisted+tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-twisted+tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm3"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3","0.3.2~RC1-3ubuntu0.1~esm1","0.3.2~RC1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm4"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1","2.1.8-1ubuntu0.1~esm1","2.1.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm4"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1","3.0.7-1ubuntu0.1~esm1","3.0.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm3"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1","3.1.24-1ubuntu0.1~esm1","3.1.24-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm3"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3","0.3.2~RC1-3ubuntu0.1~esm1","0.3.2~RC1-3ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm4"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1","2.1.8-1ubuntu0.1~esm1","2.1.8-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm4"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1","3.0.7-1ubuntu0.1~esm1","3.0.7-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm3"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1","3.1.24-1ubuntu0.1~esm1","3.1.24-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-3ubuntu0.1~esm2"}]}],"versions":["3.1.30-1","3.1.37-1","3.1.37-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.46-1ubuntu0.1~esm1"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.1610074031.f653af66-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.1610074031.f653af66-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.1610074031.f653af66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.1610074031.f653af66-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.56-1.1"}]}],"bundled":3}],"products":[{"vendor":"gitpython-developers","product":"gitpython"},{"vendor":"gitpython_project","product":"gitpython"}],"references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/gitpython-developers/GitPython/pull/1672","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/74e55ee4544867e1bd976b7df5a45869ee397b0b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/e98f57b81f792f0f5e18d33ee658ae395f9aa3c4","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-165.yaml","tags":["x_refsource_MISC","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwvm-v4w8-q58c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41040.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35535","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.43","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.42","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.41","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.40","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.38","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.35","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.34","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.31","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1628","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7851","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_red_hat_satellite_to_6.14/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250343","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7851.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4886","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28362","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41040","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242493","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","tags":["article"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-get","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0190","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0190.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0215","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0215.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0322","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246264","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0322.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46137","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1640","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1640.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45857","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49083","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.3","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24680","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxj9-f6rv-m3x4","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/feb/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-41040","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8303-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44244","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZWCDOX67N4DIYNYFBVRBOV5ED6DNNQIW/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214810","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41040","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7CNHID7WWGH3NBQ4RDHSFLO7MHMZZ4ZQ/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40267","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-41040","title":"GitPython blind local file inclusion","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T21:07:42.263Z","modified":"2025-11-03T21:49:29.315Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-0087","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T21:07:42Z","modified":"2025-11-03T21:49:29Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-cwvm-v4w8-q58c","title":"GitPython blind local file inclusion","description":"### Summary\n\nIn order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system.\n\n### Details\n\nThis vulnerability is present in\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175\n\nThat code joins the base directory with a user given string without checking if the final path is located outside the base directory.\n\nI was able to exploit it from three places, but there may be more code paths that lead to it:\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L605\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L620\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/index/base.py#L1353\n\n### PoC\n\nRunning GitPython within any repo should work, here is an example with the GitPython repo.\n\n```python\nimport git\n\nr = git.Repo(\".\")\n\n# This will make GitPython read the README.md file from the root of the repo\nr.commit(\"../README.md\")\nr.tree(\"../README.md\")\nr.index.diff(\"../README.md\")\n\n# Reading /etc/random\n# WARNING: this will probably halt your system, run with caution\n# r.commit(\"../../../../../../../../../dev/random\")\n```\n\n### Impact\n\nI wasn't able to show the contents of the files (that's why \"blind\" local file inclusion), depending on how GitPython is being used, this can be used by an attacker for something _inoffensive_ as checking if a file exits, or cause a DoS by making GitPython read a big/infinite file (like `/dev/random` on Linux systems).\n\n### Possible solutions\n\nA solution would be to check that the final path isn't located outside the `repodir` path (maybe even after resolving symlinks). Maybe there could be other checks in place to make sure that the reference names are valid.","status":"published","published":"2023-08-30T20:09:36Z","modified":"2025-11-04T16:45:33Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-41040","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T22:15:09.857Z","modified":"2026-06-17T06:20:14.253Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:27.181588Z"}],"osv":[{"id":"ALPINE-CVE-2023-41040","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T22:15:09.857Z","modified":"2026-11-03T06:32:59.195916236Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2023-41040","title":"GitPython blind local file inclusion","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T21:07:42.263Z","modified":"2026-10-28T02:31:13.641840039Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41040","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T22:15:09.857Z","modified":"2026-10-26T18:02:41.528633594Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-cwvm-v4w8-q58c","title":"GitPython blind local file inclusion","description":"### Summary\n\nIn order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system.\n\n### Details\n\nThis vulnerability is present in\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175\n\nThat code joins the base directory with a user given string without checking if the final path is located outside the base directory.\n\nI was able to exploit it from three places, but there may be more code paths that lead to it:\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L605\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L620\n\nhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/index/base.py#L1353\n\n### PoC\n\nRunning GitPython within any repo should work, here is an example with the GitPython repo.\n\n```python\nimport git\n\nr = git.Repo(\".\")\n\n# This will make GitPython read the README.md file from the root of the repo\nr.commit(\"../README.md\")\nr.tree(\"../README.md\")\nr.index.diff(\"../README.md\")\n\n# Reading /etc/random\n# WARNING: this will probably halt your system, run with caution\n# r.commit(\"../../../../../../../../../dev/random\")\n```\n\n### Impact\n\nI wasn't able to show the contents of the files (that's why \"blind\" local file inclusion), depending on how GitPython is being used, this can be used by an attacker for something _inoffensive_ as checking if a file exits, or cause a DoS by making GitPython read a big/infinite file (like `/dev/random` on Linux systems).\n\n### Possible solutions\n\nA solution would be to check that the final path isn't located outside the `repodir` path (maybe even after resolving symlinks). Maybe there could be other checks in place to make sure that the reference names are valid.","status":"published","published":"2023-08-30T20:09:36Z","modified":"2025-11-04T16:49:25.840497Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"OESA-2023-1628","title":"python-GitPython security update","description":"**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are \u0026apos;cgit\u0026apos; and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.\r\n\r\nSecurity Fix(es):\r\n\r\n GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn\u0026apos;t check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has not yet been addressed.(CVE-2023-41040)","status":"published","published":"2023-09-15T11:06:04Z","modified":"2026-08-18T01:17:00.484655756Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"PYSEC-2023-165","description":" GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has not yet been addressed.","status":"published","published":"2023-08-30T22:15:00Z","modified":"2023-11-08T04:13:23.455909Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"RHSA-2023:7851","title":"Red Hat Security Advisory: Satellite 6.14.1 Async Security Update","status":"published","published":"2024-09-18T05:14:53Z","modified":"2026-09-09T10:02:38Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0190","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (GitPython) security update","status":"published","published":"2024-09-16T15:58:26Z","modified":"2026-08-07T10:11:49Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0215","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (GitPython) security update","status":"published","published":"2024-09-16T15:58:17Z","modified":"2026-08-07T10:11:51Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0322","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-16T15:58:35Z","modified":"2026-08-07T10:11:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1640","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:52:23Z","modified":"2026-10-18T10:02:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2023-41040","description":"GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.","status":"published","published":"2023-08-30T22:15:00Z","modified":"2026-05-27T10:16:12.374753264Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2025-1759191117","title":"TuxCare security update for gitpython (1 CVE)","description":"TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:48:00.891769891Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3589-1","title":"python-git - security update","status":"published","published":"2023-09-29T00:00:00Z","modified":"2026-03-09T01:23:23.002946Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3939-1","title":"python-git - security update","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-03-09T01:20:17.429769Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2026-0372","title":"Updated python-gitpython packages fix security vulnerabilities","description":"CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi\noptions in clone and clone_from. NOTE: this issue exists because of an\nincomplete fix for CVE-2022-24439.\nCVE-2023-41040 In order to resolve some git references, GitPython reads\nfiles from the `.git` directory, in some places the name of the file\nbeing read is provided by the user, GitPython doesn't check if this file\nis located outside the `.git` directory. This allows an attacker to make\nGitPython read any file from the system.\nCVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython\nblocks dangerous Git options such as --upload-pack and --receive-pack by\ndefault, but the equivalent Python kwargs upload_pack and receive_pack\nbypass that check. If an application passes attacker-controlled kwargs\ninto Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(),\nthis leads to arbitrary command execution even when allow_unsafe_options\nis left at its default value of False. This issue has been patched in\nversion 3.1.47.\n","status":"published","published":"2026-09-03T18:06:14Z","modified":"2026-09-03T18:15:02.938994693Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2023:0259-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues:\n\n- CVE-2023-41040: Fixed directory traversal attack vulnerability (boo#1214810)\n","status":"published","published":"2023-09-25T12:02:14Z","modified":"2026-02-04T02:16:17.963251Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0271-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues:\n\n- CVE-2023-41040: Fixed directory traversal attack vulnerability (boo#1214810)\n","status":"published","published":"2023-09-25T22:02:02Z","modified":"2026-02-04T04:00:31.343557Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13207-1","title":"python310-GitPython-3.1.34.1693646983.2a2ae77-1.1 on GA media","description":"These are all security issues fixed in the python310-GitPython-3.1.34.1693646983.2a2ae77-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:31.716699Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11419-1","title":"python313-GitPython-3.1.56-1.1 on GA media","description":"These are all security issues fixed in the python313-GitPython-3.1.56-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:08.021645352Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"USN-8303-1","title":"python-git vulnerabilities","description":"Santos Gallegos discovered that GitPython did not properly validate\npaths when resolving certain Git references. An attacker could possibly\nuse this issue to cause files outside the .git directory to be accessed,\nleading to a denial of service. This issue only affected Ubuntu 14.04\nLTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu\n22.04 LTS. (CVE-2023-41040)\n\nWes Ring discovered that GitPython did not properly block certain unsafe\nGit options when they were provided as Python keyword arguments. An\nattacker could possibly use this issue to cause arbitrary command\nexecution. (CVE-2026-42215)\n\nIt was discovered that GitPython did not properly validate clone options\nbefore processing them. An attacker could possibly use this issue to\ninject unsafe Git configuration, leading to arbitrary command execution\nthrough Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)\n\nIt was discovered that GitPython did not properly validate reference\npaths during reference operations. An attacker could possibly use this\nissue to write, overwrite, move, or delete files outside the repository.\n(CVE-2026-44243)\n\nDan Aridor discovered that GitPython did not properly validate\nconfiguration values before writing them to Git configuration files. An\nattacker could possibly use this issue to inject unsafe Git\nconfiguration, leading to arbitrary command execution through Git hooks.\n(CVE-2026-44244)","status":"published","published":"2026-05-26T21:52:45Z","modified":"2026-05-27T10:32:49.612604877Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}