Bug 2231474 (TRIAGE-CVE-2023-40267)

Summary:	TRIAGE-CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acrosby, adudiak, bbuckingham, bcourt, davidn, eglynn, ehelms, epacific, gblomqui, jcammara, jhardy, jjoyce, jmitchel, jneedle, jobarker, jsamir, jschluet, jsherril, jtanner, jweng, kaycoth, kshier, lhh, lzap, mabashia, mburns, mgarciac, mhulan, nmoumoul, nobody, nweather, orabin, osapryki, pcreech, pgrist, psegedy, rchan, simaishi, smcdonal, stcannon, sthirugn, teagle, tfister, tsasak, vkrizan, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2231475, 2231476, 2231477, 2231483, 2231485, 2231486, 2231487, 2231488, 2231481, 2231482, 2231484
Bug Blocks:	2231478

Description Pedro Sampaio 2023-08-11 17:03:49 UTC

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

References:

https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd
https://github.com/gitpython-developers/GitPython/pull/1609

Comment 1 Pedro Sampaio 2023-08-11 17:04:18 UTC

Created GitPython tracking bugs for this issue:

Affects: epel-all [bug 2231476]
Affects: fedora-all [bug 2231475]
Affects: openstack-rdo [bug 2231477]