CRITICAL9.8

PYSEC-2023-137

Quick fix

PYSEC-2023-137 — gitpython: upgrade to the fixed version with the command below.

pip install --upgrade 'gitpython>=ca965ecc81853bca7675261729143f54e5bf4cdd'

Details

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/gitpython

Introduced in: 0Fixed in: ca965ecc81853bca7675261729143f54e5bf4cdd

Fixpip install --upgrade 'gitpython>=ca965ecc81853bca7675261729143f54e5bf4cdd'

References

https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd[FIX]
https://github.com/gitpython-developers/GitPython/pull/1609[WEB]