Bug 31242 - python-gitpython new security issue CVE-2022-24439
Summary: python-gitpython new security issue CVE-2022-24439
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-12-07 23:33 CET by David Walser
Modified: 2023-01-13 18:38 CET (History)
5 users (show)

See Also:
Source RPM: python-gitpython-3.1.17-3.mga9.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-12-07 23:33:08 CET 
A security issue in GitPython just became public:
https://github.com/gitpython-developers/GitPython/issues/1515
https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858

There is no fix available yet, but hopefully there will be soon.
David Walser 2022-12-07 23:33:15 CET

Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2022-12-08 21:15:48 CET 
Assigning anyway to the Python people.
Who is going to notice the fix when published?

Assignee: bugsquad => python

Comment 2 David Walser 2023-01-04 19:09:12 CET 
Fedora has issued an advisory for this today (January 4):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/

The issue is fixed upstream in 3.1.30.

Status comment: (none) => Fixed upstream in 3.1.30
Severity: normal => critical

Comment 3 papoteur 2023-01-04 19:53:15 CET 
Updated in cauldron

Version: Cauldron => 8
CC: (none) => yves.brungard_mageia
Whiteboard: MGA8TOO => (none)

Comment 4 papoteur 2023-01-04 20:08:40 CET 
Now in Mageia 8 testing:
python3-gitpython-3.1.30-1.mga8

Source:
python-gitpython-3.1.30-1.mga8

Status comment: Fixed upstream in 3.1.30 => (none)
Assignee: python => qa-bugs

Comment 5 Herman Viaene 2023-01-06 17:09:35 CET 
MGA8-644 MATE on Acer Aspire 5253
No installation issues.
Following procedure from bug 18540 Comment 5, first installed git and its dependencies, then
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Cloning into 'linux'...
remote: Enumerating objects: 539, done.
remote: Counting objects: 100% (539/539), done.
remote: Compressing objects: 100% (307/307), done.
remote: Total 9229031 (delta 342), reused 314 (delta 232), pack-reused 9228492
Receiving objects: 100% (9229031/9229031), 2.54 GiB | 4.41 MiB/s, done.
Resolving deltas: 100% (7565206/7565206), done.
Checking objects: 100% (33554432/33554432), done.
Updating files: 100% (79495/79495), done.

$ python3
Python 3.8.14 (default, Oct  4 2022, 06:27:18) 
[GCC 10.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from git import repo
>>> rp = repo.Repo('~/linux/')
>>> cm = rp.commit("ad3e2751e7")
>>> cm.stats.files.keys()
dict_keys(['drivers/ntb/ntb_hw.c'])
>>> exit()

That is exactly the same, so OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 6 Thomas Andrews 2023-01-07 13:58:49 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2023-01-11 04:23:53 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 7 Mageia Robot 2023-01-13 18:38:31 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0001.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.