Bug 2552997 (CVE-2026-110855)
| Summary: | CVE-2026-110855 GitPython: GitPython: Information disclosure via environment variable expansion in submodule names | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alinfoot, anthomas, bbrownin, dschmidt, dtrifiro, eglynn, ehelms, gbenhaim, ggainey, ikhan, ilpinto, jdobes, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, kaycoth, kshier, lhh, ltomasbo, mburns, mdellweg, mgarciac, mhulan, niyer, nmoumoul, orabin, osousa, pcreech, rbobbitt, rchan, simaishi, smallamp, stcannon, tmalecek, twaugh, weaton, yguenane, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GitPython. This vulnerability allows a remote attacker to cause information disclosure by convincing an application or user to clone and update a repository containing a specially crafted submodule configuration. When handling submodule definitions, GitPython improperly expands environment variables instead of treating the values literally. Consequently, sensitive data such as system secrets or access credentials may be exposed in directory paths and debug logs.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-14 23:04:33 UTC
|