Bug 2515269 (CVE-2026-73622)
| Summary: | CVE-2026-73622 gitpython: GitPython: Information disclosure via environment variable expansion in URL handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | alinfoot, anthomas, bbrownin, derez, dfreiber, drow, dschmidt, dtrifiro, eglynn, ehelms, ggainey, jburrell, jdobes, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, kaycoth, kshier, lhh, mburns, mdellweg, mgarciac, mhulan, nmoumoul, orabin, osousa, pcreech, rbryant, rchan, rjohnson, simaishi, smallamp, stcannon, teagle, tmalecek, vkumar, weaton, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted to attacker-controlled hosts, leading to information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-13 12:18:33 UTC
|