CVE-2022-24439

描述

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

如何修補 CVE-2022-24439

要修補 CVE-2022-24439,請將受影響套件升級到下列已修補版本。

• —升級至 3.1.14-1+deb11u1 或更新版本
• —升級至 2.1.11-1+deb10u1 或更新版本
• —升級至 3.1.14-1+deb11u1 或更新版本
• —升級至 3.1.30 或更新版本
• —升級至 3.1.30 或更新版本

CVE-2022-24439 正在被利用嗎?

中等 — EPSS 為 5.4%,可持續追蹤但非最高優先。

受影響套件(5)

• from 0, < 3.1.14-1+deb11u1
• from 0, < 2.1.11-1+deb10u1
• from 0, < 3.1.14-1+deb11u1
• from 0, < 3.1.30
• from 0, < 3.1.30

CVSS 分數

參考連結(24)

• ADVISORYgithub.com/advisories/GHSA-hcpj-qp55-gfph
• ADVISORYlists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/
• ADVISORYlists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/
• ADVISORY