Bug 1214810 (CVE-2023-41040) - VUL-0: CVE-2023-41040: python-GitPython: Blind local file inclusion
Summary: VUL-0: CVE-2023-41040: python-GitPython: Blind local file inclusion
Status: IN_PROGRESS
Alias: CVE-2023-41040
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/376794/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-41040:4.0:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-31 07:43 UTC by Cathy Hu
Modified: 2023-10-27 06:41 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cathy Hu 2023-08-31 07:43:06 UTC
CVE-2023-41040

 GitPython is a python library used to interact with Git repositories. In order
to resolve some git references, GitPython reads files from the `.git` directory,
in some places the name of the file being read is provided by the user,
GitPython doesn't check if this file is located outside the `.git` directory.
This allows an attacker to make GitPython read any file from the system. This
vulnerability is present in
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175.
That code joins the base directory with a user given string without checking if
the final path is located outside the base directory. This vulnerability cannot
be used to read the contents of files but could in theory be used to trigger a
denial of service for the program. This issue has not yet been addressed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-41040
https://www.cve.org/CVERecord?id=CVE-2023-41040
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
Comment 1 Cathy Hu 2023-08-31 07:44:25 UTC
Affected:
- SUSE:ALP:Source:Standard:1.0/python-GitPython                   3.1.32
- SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/python-GitPython  2.1.8                     
- SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-GitPython  2.1.11                    
- openSUSE:Backports:SLE-15-SP4/python-GitPython                  3.1.12
- openSUSE:Factory/python-GitPython                               3.1.32
Comment 2 Cathy Hu 2023-08-31 07:46:48 UTC
since cvss < 7, wontfix for cloud8 and cloud9
Comment 3 Daniel Garcia 2023-09-05 06:48:38 UTC
There's no upstream solution yet. I'm following the bug in github to track the issue https://github.com/gitpython-developers/GitPython/issues/1638
Comment 4 Daniel Garcia 2023-09-05 08:11:27 UTC
Upstream patch in progress: https://github.com/gitpython-developers/GitPython/pull/1644
Comment 5 OBSbugzilla Bot 2023-09-07 06:45:03 UTC
This is an autogenerated message for OBS integration:
This bug (1214810) was mentioned in
https://build.opensuse.org/request/show/1109413 Factory / python-GitPython
Comment 8 OBSbugzilla Bot 2023-09-07 07:35:03 UTC
This is an autogenerated message for OBS integration:
This bug (1214810) was mentioned in
https://build.opensuse.org/request/show/1109428 Backports:SLE-15-SP4 / python-GitPython
https://build.opensuse.org/request/show/1109431 Backports:SLE-15-SP5 / python-GitPython
Comment 10 Marcus Meissner 2023-09-25 16:09:23 UTC
openSUSE-SU-2023:0259-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1214810
CVE References: CVE-2023-41040
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    python-GitPython-3.1.12.1610074031.f653af66-bp155.3.3.1
Comment 11 Marcus Meissner 2023-09-26 01:08:48 UTC
openSUSE-SU-2023:0271-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1214810
CVE References: CVE-2023-41040
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP4 (src):    python-GitPython-3.1.12.1610074031.f653af66-bp154.2.3.1