Advisories ยป MGASA-2026-0372

Updated python-gitpython packages fix security vulnerabilities

Publication date: 03 Sep 2026
Modification date: 03 Sep 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-40267 , CVE-2023-41040 , CVE-2026-42215

Description

CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi
options in clone and clone_from. NOTE: this issue exists because of an
incomplete fix for CVE-2022-24439.
CVE-2023-41040 In order to resolve some git references, GitPython reads
files from the `.git` directory, in some places the name of the file
being read is provided by the user, GitPython doesn't check if this file
is located outside the `.git` directory. This allows an attacker to make
GitPython read any file from the system.
CVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython
blocks dangerous Git options such as --upload-pack and --receive-pack by
default, but the equivalent Python kwargs upload_pack and receive_pack
bypass that check. If an application passes attacker-controlled kwargs
into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(),
this leads to arbitrary command execution even when allow_unsafe_options
is left at its default value of False. This issue has been patched in
version 3.1.47.

References

SRPMS

9/core