Skip to content
Fencer Vulns
medium 4.0

CVE-2023-41040 json

GitPython blind local file inclusion

published 2023-08-30 3 y ago modified 2026-06-17 4 mo ago also GHSA-cwvm-v4w8-q58c , PYSEC-2023-165 , EUVD-2023-0087

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

Patch / fix

  • pypi gitpython 3.1.35, 3.1.37
  • python-git Debian 12 3.1.30-1+deb12u2
  • python-git Debian 14, Debian 13 3.1.36-1

debian advisories DEBIAN-CVE-2023-41040

  • python-git Ubuntu Pro 14.04 LTS 0.3.2~RC1-3ubuntu0.1~esm3
  • python-git Ubuntu Pro 16.04 LTS 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4
  • python-git Ubuntu Pro 18.04 LTS 2.1.8-1ubuntu0.1~esm4
  • python-git Ubuntu Pro 20.04 LTS 3.0.7-1ubuntu0.1~esm4
  • python-git Ubuntu Pro 22.04 LTS 3.1.24-1ubuntu0.1~esm3

ubuntu advisories UBUNTU-CVE-2023-41040

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el8ap
  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el9ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el8ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el9ap
  • python-django ansible automation platform 2.4 4.2.11-1.el9ap
  • python-aiohttp ansible automation platform 2.4 3.9.3-1.el9ap
  • python3-django ansible automation platform 2.4 4.2.11-1.el9ap
  • python3-aiohttp ansible automation platform 2.4 3.9.3-1.el9ap

red hat advisories RHSA-2024:1640RHSA-2023:7851RHSA-2024:0322RHSA-2024:0190RHSA-2024:0215

  • python-GitPython openSUSE Tumbleweed 3.1.56-1.1
  • python-GitPython Package Hub 15 SP4, openSUSE Leap 15.4 3.1.12.1610074031.f653af66-bp154.2.3.1
  • python-GitPython Package Hub 15 SP5, openSUSE Leap 15.5 3.1.12.1610074031.f653af66-bp155.3.3.1

opensuse advisories openSUSE-SU-2026:11419-1openSUSE-SU-2023:0271-1openSUSE-SU-2023:0259-1

  • py3-gitpython Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 3.1.37-r0

alpine advisories ALPINE-CVE-2023-41040

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-41040 updated cvss 5.1

GitPython: Blind local file inclusion

  • Red Hat Certification for Red Hat Enterprise Linux 7 redhat-certification
    affected: no fix planned “Out of support scope”
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification Red Hat OpenStack Platform 16.1 python3-GitPython Red Hat OpenStack Platform 16.2 python3-GitPython
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-gitpython 3.1.40-1.el8ap, python3x-gitpython 3.1.40-1.el8ap, automation-controller-venv-tower 4.5.5-2.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-gitpython 3.1.40-1.el9ap, python3-gitpython 3.1.40-1.el9ap, automation-controller-venv-tower 4.5.5-2.el9ap
    fixed: vendor fix RHSA-2024:1640
  • Red Hat OpenStack Platform 17.1 GitPython 3.1.14-2.el8ost, GitPython 3.1.14-2.el9ost, python3-GitPython 3.1.14-2.el8ost, python3-GitPython 3.1.14-2.el9ost
    fixed: vendor fix RHSA-2024:0190
  • Red Hat Satellite 6.14 for RHEL 8 python-gitpython 3.1.40-0.1.el8pc, python39-gitpython 3.1.40-0.1.el8pc
    fixed: vendor fix RHSA-2023:7851
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.5-1.el8ap, receptorctl 1.4.5-1.el8ap, ansible-core 2.15.10-1.el8ap, ansible-runner 2.3.6-1.el8ap, ansible-test 2.15.10-1.el8ap, python39-aiohttp 3.9.3-1.el8ap, +15 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.5-1.el9ap, receptorctl 1.4.5-1.el9ap, ansible-core 2.15.10-1.el9ap, ansible-runner 2.3.6-1.el9ap, ansible-test 2.15.10-1.el9ap, python-aiohttp 3.9.3-1.el9ap, +15 more Red Hat Satellite 6.14 for RHEL 8 foreman 3.7.0.10-1.el8sat, satellite 6.14.1-1.el8sat, createrepo_c 1.0.2-2.el8pc, foreman-cli 3.7.0.10-1.el8sat, foreman-ec2 3.7.0.10-1.el8sat, satellite-cli 6.14.1-1.el8sat, +45 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.09% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
GitHub 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi gitpython
<3.1.37
<3.1.35
3.1.37
3.1.35

Affected products

  • gitpython-developers GitPython

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.