Source: python-git Version: 3.1.50-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for python-git. CVE-2026-73619[0]: | GitPython before 3.1.57 contains an incomplete denylist in the | unsafe_git_archive_options guard that omits --add-file and --add- | virtual-file options. Attackers can supply these options to | Repo.archive() to read arbitrary files from the filesystem and | include them in the returned archive. CVE-2026-73620[1]: | GitPython before 3.1.57 fails to guard git option forwarding in | IndexFile.checkout() and TagReference.create(), allowing attackers | to pass unsafe options via kwargs. Attackers can use --prefix to | overwrite arbitrary files with repository content or -F to read | arbitrary files returned in-band. CVE-2026-73621[2]: | GitPython before 3.1.56 contains an argument injection vulnerability | in the Commit.count() method, which forwards keyword arguments to | 'git rev-list' without the check_unsafe_options guard present in the | sibling iter_items method. An attacker who can control options | passed to Commit.count (e.g., via an application that forwards a | user-supplied options dict) can supply output=<path>, causing 'git | rev-list --output=<path>' to open and truncate the target file to | zero bytes before revision parsing. This allows destruction/blanking | of an arbitrary file at the process's privilege level (no content | control, 0-byte truncation). CVE-2026-73622[3]: | GitPython before 3.1.55 fails to disable environment variable | expansion in Remote.create() and Submodule.add() URL handling, | allowing attackers to exfiltrate secrets by supplying URLs | containing variable references. Attackers can craft URLs with | environment variable tokens that are expanded into .git/config and | .gitmodules, then transmitted to attacker-controlled hosts during | fetch or pull operations. CVE-2026-73623[4]: | GitPython before 3.1.54 contains an incomplete denylist in | unsafe_git_clone_options that omits --template, allowing attackers | to achieve arbitrary command execution during clone operations. | Attackers can supply --template pointing to a directory containing | malicious post-checkout hooks that execute when git clones the | repository. CVE-2026-73624[5]: | GitPython versions before 3.1.54 contain an arbitrary file overwrite | vulnerability in the Diffable.diff method that fails to validate git | options passed through kwargs. Attackers can supply the --output | argument via the other parameter or output kwarg to write patch | content to attacker-chosen file paths at process privilege level. CVE-2026-73625[6]: | GitPython versions before 3.1.54 contain a remote code execution | vulnerability in the check_unsafe_options guard that can be bypassed | by smuggling git options inside single-character kwarg values. | Attackers can supply crafted option dictionaries to clone_from, | fetch, pull, push, ls_remote, iter_commits, blame, or archive | methods to execute arbitrary OS commands via the --upload-pack | parameter. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73619 https://www.cve.org/CVERecord?id=CVE-2026-73619 [1] https://security-tracker.debian.org/tracker/CVE-2026-73620 https://www.cve.org/CVERecord?id=CVE-2026-73620 [2] https://security-tracker.debian.org/tracker/CVE-2026-73621 https://www.cve.org/CVERecord?id=CVE-2026-73621 [3] https://security-tracker.debian.org/tracker/CVE-2026-73622 https://www.cve.org/CVERecord?id=CVE-2026-73622 [4] https://security-tracker.debian.org/tracker/CVE-2026-73623 https://www.cve.org/CVERecord?id=CVE-2026-73623 [5] https://security-tracker.debian.org/tracker/CVE-2026-73624 https://www.cve.org/CVERecord?id=CVE-2026-73624 [6] https://security-tracker.debian.org/tracker/CVE-2026-73625 https://www.cve.org/CVERecord?id=CVE-2026-73625 Regards, Salvatore
