Bug 2467796 (CVE-2026-44243)
| Summary: | CVE-2026-44243 GitPython: GitPython: Arbitrary file write via crafted reference paths | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alinfoot, anthomas, bbrownin, derez, dfreiber, drow, dschmidt, dtrifiro, eglynn, ehelms, erezende, ggainey, jburrell, jdobes, jjoyce, jkoehler, jlanda, jmitchel, jpretori, jschluet, juwatts, kaycoth, kshier, lhh, lphiri, mburns, mgarciac, mhulan, nmoumoul, orabin, osousa, pcreech, rbryant, rchan, rjohnson, simaishi, smallamp, smcdonal, stcannon, teagle, tmalecek, vkumar, weaton, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows attackers to supply a specially crafted reference path to an application utilizing GitPython. Due to insufficient validation of these paths during reference creation, renaming, or deletion, an attacker can write, overwrite, move, or delete files outside the intended Git repository directory. This could lead to unauthorized modification or deletion of critical system files.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-05-07 19:01:33 UTC
|