CVE-2023-40267 json
GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
published 2023-08-11 3 y ago modified 2026-06-17 4 mo ago also GHSA-pr76-5cm5-w9cj , PYSEC-2023-137 , EUVD-2023-0085
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Patch / fix
- pypi gitpython 3.1.32
- gitpython_project gitpython 3.1.32
- python-git Debian 12 3.1.30-1+deb12u2
- python-git Debian 14, Debian 13 3.1.36-1
debian advisories DEBIAN-CVE-2023-40267
- python-git Ubuntu Pro 14.04 LTS 0.3.2~RC1-3ubuntu0.1~esm2
- python-git Ubuntu Pro 16.04 LTS 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
- python-git Ubuntu Pro 18.04 LTS 2.1.8-1ubuntu0.1~esm2
- python-git Ubuntu Pro 20.04 LTS 3.0.7-1ubuntu0.1~esm2
- python-git Ubuntu Pro 22.04 LTS 3.1.24-1ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2023-40267
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- foreman satellite utils 6.14, satellite capsule 6.14, satellite 6.14 3.7.0.9-1.el8sat
- foreman-cli satellite utils 6.14, satellite 6.14 3.7.0.9-1.el8sat
- foreman-ec2 satellite 6.14 3.7.0.9-1.el8sat
- rubygem-git satellite 6.14, satellite 6.13 1.18.0-1.el8sat
- puppet-agent satellite capsule 6.14, satellite capsule 6.13, satellite 6.14 +1 more 7.26.0-3.el8sat
- puppetserver satellite capsule 6.14, satellite 6.14 7.11.0-1.el8sat
- rubygem-rack satellite capsule 6.14, satellite 6.14 2.2.7-1.el8sat
- foreman-ovirt satellite 6.14 3.7.0.9-1.el8sat
red hat advisories RHSA-2023:6818RHSA-2023:5931RHSA-2023:4991RHSA-2023:4971
- python-GitPython openSUSE Tumbleweed 3.1.56-1.1
opensuse advisories openSUSE-SU-2026:11419-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-40267 updated cvss 9.8
GitPython: Insecure non-multi options in clone and clone_from is not blocked
-
Red Hat Ansible Tower 3 gitpythonaffected: no fix available
-
Red Hat Certification for Red Hat Enterprise Linux 6 redhat-certification-backend Red Hat Certification for Red Hat Enterprise Linux 7 redhat-certificationaffected: no fix planned “Out of support scope”
-
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification Red Hat OpenStack Platform 16.1 python3-GitPython Red Hat OpenStack Platform 16.2 python3-GitPython Red Hat OpenStack Platform 17.0 python3-GitPython Red Hat OpenStack Platform 17.1 GitPython, python3-GitPythonaffected: no fix available “Fix deferred”
-
Red Hat Ansible Automation Platform 2.3 for RHEL 8 automation-controller-venv-tower 4.3.13-1.el8ap Red Hat Ansible Automation Platform 2.3 for RHEL 9 automation-controller-venv-tower 4.3.13-1.el9apfixed: vendor fix RHSA-2023:4991
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-gitpython 3.1.32-1.el8ap, python3x-gitpython 3.1.32-1.el8ap, automation-controller-venv-tower 4.4.3-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-gitpython 3.1.32-1.el9ap, python3-gitpython 3.1.32-1.el9ap, automation-controller-venv-tower 4.4.3-1.el9apfixed: vendor fix RHSA-2023:4971
-
Red Hat Satellite 6.13 for RHEL 8 python-gitpython 3.1.32-1.el8pc, python39-gitpython 3.1.32-1.el8pcfixed: vendor fix RHSA-2023:5931
-
Red Hat Satellite 6.14 for RHEL 8 python-gitpython 3.1.32-1.el8pc, python39-gitpython 3.1.32-1.el8pcfixed: vendor fix RHSA-2023:6818
-
Red Hat Ansible Automation Platform 1.2 gitpython Red Hat Ansible Automation Platform 2.3 for RHEL 8 ansible-core 2.14.9-1.el8ap, ansible-test 2.14.9-1.el8ap, automation-controller 4.3.13-1.el8ap, automation-controller-ui 4.3.13-1.el8ap, automation-controller-cli 4.3.13-1.el8ap, automation-controller-server 4.3.13-1.el8ap Red Hat Ansible Automation Platform 2.3 for RHEL 9 ansible-core 2.14.9-1.el9ap, ansible-test 2.14.9-1.el9ap, automation-controller 4.3.13-1.el9ap, automation-controller-ui 4.3.13-1.el9ap, automation-controller-cli 4.3.13-1.el9ap, automation-controller-server 4.3.13-1.el9ap Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core 2.15.3-1.el8ap, ansible-test 2.15.3-1.el8ap, automation-controller 4.4.3-1.el8ap, automation-controller-ui 4.4.3-1.el8ap, automation-controller-cli 4.4.3-1.el8ap, automation-controller-server 4.4.3-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core 2.15.3-1.el9ap, ansible-test 2.15.3-1.el9ap, automation-controller 4.4.3-1.el9ap, automation-controller-ui 4.4.3-1.el9ap, automation-controller-cli 4.4.3-1.el9ap, automation-controller-server 4.4.3-1.el9ap Red Hat OpenStack Platform 18.0 GitPythonnot affected: vulnerable code not present
+2 more productsfewer
Red Hat Satellite 6.13 for RHEL 8 foreman 3.5.1.23-1.el8sat, satellite 6.13.5-1.el8sat, rubygem-git 1.18.0-1.el8sat, puppet-agent 7.26.0-3.el8sat, python-django 3.2.21-1.el8pc, foreman-cli 3.5.1.23-1.el8sat, +24 more Red Hat Satellite 6.14 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.9.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, candlepin 4.3.1-1.el8sat, +667 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gitpython | <3.1.32 |
3.1.32 |
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/gitpython-developers/GitPython/pull/1609
web, issue-tracking, patch
-
github.com
/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd
web, patch
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
vendor-advisory
-
lists.debian.org
/debian-lts-announce/2024/10/msg00030.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-40267
advisory
-
github.com
/gitpython-developers/GitPython
package
-
github.com
/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-137.yaml
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
web
Sources
- CVE List CVE-2023-40267
- GitHub Advisory GHSA-pr76-5cm5-w9cj
- NVD CVE-2023-40267
- OSV PYSEC-2023-137
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.