Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-76222 →
DEBIAN-CVE-2026-76222
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesyste...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}]
Références
- advisory security-tracker.debian.org