このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-69097 の詳細 →
UBUNTU-CVE-2026-69097
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives th...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:Pro:14.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:26.04:LTS
python-git
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report github.com
- report vulncheck.com