python3.12-gitpython vulnerabilities (Red Hat)
39 vulnerabilities.
python3.12-gitpythonRed HatGitPython before 3.1.59 Arbitrary File Read via TagReference.create7.1 Highpython3.12-gitpythonRed HatGitPython before 3.1.59 Path Traversal via separate-git-dir8.7 Highpython3.12-gitpythonRed HatAwx: notification backends allow ssrf and credential leakage7.7 Highpython3.12-gitpythonRed HatAwx: project archive extraction allows path traversal file writes7.2 Highpython3.12-gitpythonRed HatAwx: webhook status callback ssrf leaks the git pat7.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.58 Command Execution via split_single_char_options8.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.58 Config Injection via option-name8.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name8.4 Highpython3.12-gitpythonRed HatGitPython before 3.1.58 Remote Code Execution via Repo.init7.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.58 Arbitrary File Overwrite via read-tree7.2 Highpython3.12-gitpythonRed HatServer-side file-write and request forgery via spatial lookups8.7 Highpython3.12-gitpythonRed HatAIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)7.1 Highpython3.12-gitpythonRed HatGitPython before 3.1.57 Arbitrary File Overwrite and Read7.2 Highpython3.12-gitpythonRed HatGitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()8.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.54 Remote Code Execution via kwarg value smuggling8.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.54 Remote Code Execution via --template7.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.54 Arbitrary File Overwrite via diff7.2 Highpython3.12-gitpythonRed HatGitPython before 3.1.52 Environment Variable Exfiltration via clone_from8.7 Highpython3.12-gitpythonRed Hatjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)8.7 Highpython3.12-gitpythonRed HatGitPython before 3.1.51 Command Injection via unguarded Git options8.6 Highpython3.12-gitpythonRed HatGitPython before 3.1.51 Command Injection via option prefix abbreviation8.7 Highpython3.12-gitpythonRed HatGitPython 3.1.50 Authentication Bypass via Joined Short Options9.3 Criticalpython3.12-gitpythonRed HatAnsible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)7.8 Highpython3.12-gitpythonRed Hatpyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 Highpython3.12-gitpythonRed HatEclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections6.9 Mediumpython3.12-gitpythonRed Hatjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1 Highpython3.12-gitpythonRed Hatform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7 Highpython3.12-gitpythonRed HatAwxkit: path traversal via yaml !include directive4.7 Mediumpython3.12-gitpythonRed HatAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution7.8 Highpython3.12-gitpythonRed HatUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service5.3 Mediumpython3.12-gitpythonRed HatAIOHTTP Vulnerable to Deserialization of Untrusted Data6.4 Mediumpython3.12-gitpythonRed Hattmp: Path Traversal via unsanitized prefix/postfix enables directory escape7.7 Highpython3.12-gitpythonRed Hat`jwt` (Ruby gem) - empty-key HMAC bypass9.1 Criticalpython3.12-gitpythonRed HatGitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath7.8 Highpython3.12-gitpythonRed HatGitPython: Command injection via Git options bypass8.8 Highpython3.12-gitpythonRed HatGitPython: Unsafe option check validates multi_options before shlex.split transforms it8.1 Highpython3.12-gitpythonRed HatJWCrypto: JWE ZIP decompression bomb5.3 Mediumpython3.12-gitpythonRed HatOut-of-bounds read & write in RFC 3211 KEK Unwrap9.8 Criticalpython3.12-gitpythonRed HatAIOHTTP: HTTP request smuggling via WebSocket upgrade6.3 Medium