CVE-2022-24439

Description

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

How to fix CVE-2022-24439

To remediate CVE-2022-24439, upgrade the affected package to a fixed version below.

—upgrade to 3.1.14-1+deb11u1 or later
—upgrade to 2.1.11-1+deb10u1 or later
—upgrade to 3.1.14-1+deb11u1 or later
—upgrade to 3.1.30 or later
—upgrade to 3.1.30 or later

Is CVE-2022-24439 being exploited?

Moderate — EPSS is 5.4%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (5)

from 0, < 3.1.14-1+deb11u1
from 0, < 2.1.11-1+deb10u1
from 0, < 3.1.14-1+deb11u1
from 0, < 3.1.30
from 0, < 3.1.30

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H