Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-67326 →

DEBIAN-CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary secti...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.50-1"}]}]

Références

advisory security-tracker.debian.org