Repository navigation
CVE-2023-40590: Untrusted search path on Windows systems leading to arbitrary code execution #1635
Description
Activity
- changed the title
[-]CVE-2023-40267: Remote Code Execution (RCE) [/-][+]CVE-2023-40590: Remote Code Execution (RCE) [/+]on Aug 30, 2023 - changed the title
[-]CVE-2023-40590: Remote Code Execution (RCE) [/-][+]CVE-2023-40590: Untrusted search path on Windows systems leading to arbitrary code execution [/+]on Aug 30, 2023 Thanks. This advisory originated in this repository and is thus known: GHSA-wfm5-v35h-vwf4 .
However, it seems hard to communicate using an advisory, so we can keep this issue open to collect comments.
Reacted by Eliah Kagan- added a commit that references this issue
on Aug 30, 2023 BTW, there is another vulnerability that was reported, that is also pending a fix GHSA-cwvm-v4w8-q58c. Looks like a CVE wasn't requested for that one.
I thought for something less critical, it wouldn't be worth a whole CVE entry.
As collaborator (and author) of the GHSA, are you able to request a CVE? If so, please go ahead if you think there should be one. Otherwise I will do it as per your request. Thanks.@Byron only maintainers can request CVEs. If this was intentional, I don't mind having no CVE for that advisory 👍, I was suggesting it since it looks like people are more pending on CVEs than plain advisories (or that seems to me). We could also create a new issue linking to the advisory, so people are more aware of it.
I am happy to follow your advise and requested a CVE. It should increase visibility and with that, the chance for a fix.
Reacted by Santos Gallegos, Eliah Kagan and igirardiThe fix was released here: https://pypi.org/project/GitPython/3.1.33/
Reacted by offa, Eliah Kagan, Adrian Dischinger and igirardiReacted by offa, Eliah Kagan, igirardi and Kurt von Laven
This appeared in the CVE additional information here GHSA-wfm5-v35h-vwf4.
I found it reported already. I am reporting it here just in case.