CVE-2023-41040

Name	CVE-2023-41040
Description	GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3589-1, DLA-3939-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-git (PTS)	jessie	0.3.2~RC1-3	vulnerable
	stretch (lts), stretch	2.1.1-2+deb9u1	fixed
	buster (security), buster, buster (lts)	2.1.11-1+deb10u2	fixed
	bullseye	3.1.14-1	vulnerable
	bullseye (security)	3.1.14-1+deb11u1	fixed
	bookworm	3.1.30-1+deb12u2	fixed
	sid, trixie	3.1.37-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
python-git	source	jessie	(unfixed)	end-of-life
python-git	source	stretch	(not affected)
python-git	source	buster	2.1.11-1+deb10u2		DLA-3589-1
python-git	source	bullseye	3.1.14-1+deb11u1		DLA-3939-1
python-git	source	bookworm	3.1.30-1+deb12u2
python-git	source	(unstable)	3.1.36-1

Notes

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
Fixed by: https://github.com/gitpython-developers/GitPython/commit/64ebb9fcdfbe48d5d61141a557691fd91f1e88d6 (3.1.35)
Testcase: https://github.com/gitpython-developers/GitPython/commit/65b8c6a2ccacdf26e751cd3bc3c5a7c9e5796b56 (3.1.35)
[stretch] - python-git <not-affected> (The vulnerable code was introduced later)