Source: python-git Version: 3.1.50-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for python-git. CVE-2026-78675[0]: | GitPython before 3.1.59 fails to disable merge_includes when parsing | .gitmodules, allowing attackers to disclose local file content by | including arbitrary file paths via [include] directives. Attackers | can craft a malicious .gitmodules file with include directives | pointing to sensitive files; when repo.submodules is accessed, | GitConfigParser raises MissingSectionHeaderError embedding the | target file's first line verbatim in the exception message. CVE-2026-78676[1]: | GitPython before 3.1.59 fails to safely re-serialize multi-line git- | config values during write operations, corrupting dormant quoted | values into injected directives like core.hooksPath. Attackers can | craft config files with embedded newlines that become live git | directives after any unrelated GitPython config write, enabling | arbitrary code execution via hook invocation. CVE-2026-78677[2]: | GitPython before 3.1.59 omits --separate-git-dir from | unsafe_git_clone_options, allowing attackers to create arbitrary git | directories outside the intended clone destination. Attackers can | pass a separate_git_dir parameter to Repo.clone_from() or | Repo.clone() to redirect repository metadata to an attacker- | controlled filesystem path, enabling arbitrary directory creation | and potential hook execution. CVE-2026-78678[3]: | GitPython versions before 3.1.59 contain an incomplete denylist in | the unsafe_git_revision_options guard that omits --contents and -S | options, allowing attackers to read arbitrary files by passing these | options to Repo.blame(). Attackers can supply revision values like | --contents=/etc/passwd to leak file contents through the blame | result returned to the caller. CVE-2026-78679[4]: | GitPython before 3.1.59 contains an arbitrary file read | vulnerability in TagReference.create() where a positional reference | parameter bypasses the unsafe option guard. Attackers can supply a | reference value like --file=<path> to read arbitrary files, with | contents returned in the annotated tag message. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-78675 https://www.cve.org/CVERecord?id=CVE-2026-78675 [1] https://security-tracker.debian.org/tracker/CVE-2026-78676 https://www.cve.org/CVERecord?id=CVE-2026-78676 [2] https://security-tracker.debian.org/tracker/CVE-2026-78677 https://www.cve.org/CVERecord?id=CVE-2026-78677 [3] https://security-tracker.debian.org/tracker/CVE-2026-78678 https://www.cve.org/CVERecord?id=CVE-2026-78678 [4] https://security-tracker.debian.org/tracker/CVE-2026-78679 https://www.cve.org/CVERecord?id=CVE-2026-78679 Regards, Salvatore
