Update dependency GitPython to v3.1.37 [SECURITY] - autoclosed
Metadata
Current evaluation
Automatically closed by Renovate after proposing GitPython v3.1.37 to fix CVE-2023-40267 and CVE-2023-41040. With zero reviews or CI checks, the update was superseded or resolved through an alternative channel.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [GitPython](https://togithub.com/gitpython-developers/GitPython) | `==3.1.30` -> `==3.1.37` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2023-40267](https://nvd.nist.gov/vuln/detail/CVE-2023-40267)
GitPython before 3.1.32 does not block insecure non-multi options in `clone` and `clone_from`, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
#### [CVE-2023-41040](https://togithub.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c)
### Summary
In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system.
### Details
This vulnerability is present in
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175
That code joins the base directory with a user given string without checking if the final path is located outside the base directory.
I was able to exploit it from three places, but there may be more code paths that lead to it:
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L605
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L620
https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/index/base.py#L1353
### PoC
Running GitPython within any repo should work, here is an example with the GitPython repo.
```python
import git
r = git.Repo(".")
# This will make GitPython read the README.md file from the root of the repo
r.commit("../README.md")
r.tree("../README.md")
r.index.diff("../README.md")
# Reading /etc/random
# WARNING: this will probably halt your system, run with caution
# r.commit("../../../../../../../../../dev/random")
```
### Impact
I wasn't able to show the contents of the files (that's why "blind" local file inclusion), depending on how GitPython is being used, this can be used by an attacker for something _inoffensive_ as checking if a file exits, or cause a DoS by making GitPython read a big/infinite file (like `/dev/random` on Linux systems).
### Possible solutions
A solution would be to check that the final path isn't located outside the `repodir` path (maybe even after resolving symlinks). Maybe there could be other checks in place to make sure that the reference names are valid.
---
> [!NOTE]
> This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.
---
### Release Notes
<details>
<summary>gitpython-developers/GitPython (GitPython)</summary>
### [`v3.1.37`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.37): - a proper fix CVE-2023-41040
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.36...3.1.37)
#### What's Changed
- Improve Python version and OS compatibility, fixing deprecations by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1654](https://togithub.com/gitpython-developers/GitPython/pull/1654)
- Better document env_case test/fixture and cwd by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1657](https://togithub.com/gitpython-developers/GitPython/pull/1657)
- Remove spurious executable permissions by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1658](https://togithub.com/gitpython-developers/GitPython/pull/1658)
- Fix up checks in Makefile and make them portable by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1661](https://togithub.com/gitpython-developers/GitPython/pull/1661)
- Fix URLs that were redirecting to another license by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1662](https://togithub.com/gitpython-developers/GitPython/pull/1662)
- Assorted small fixes/improvements to root dir docs by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1663](https://togithub.com/gitpython-developers/GitPython/pull/1663)
- Use venv instead of virtualenv in test_installation by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1664](https://togithub.com/gitpython-developers/GitPython/pull/1664)
- Omit py_modules in setup by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1665](https://togithub.com/gitpython-developers/GitPython/pull/1665)
- Don't track code coverage temporary files by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1666](https://togithub.com/gitpython-developers/GitPython/pull/1666)
- Configure tox by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1667](https://togithub.com/gitpython-developers/GitPython/pull/1667)
- Format tests with black and auto-exclude untracked paths by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1668](https://togithub.com/gitpython-developers/GitPython/pull/1668)
- Upgrade and broaden flake8, fixing style problems and bugs by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1673](https://togithub.com/gitpython-developers/GitPython/pull/1673)
- Fix rollback bug in SymbolicReference.set_reference by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1675](https://togithub.com/gitpython-developers/GitPython/pull/1675)
- Remove `@NoEffect` annotations by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1677](https://togithub.com/gitpython-developers/GitPython/pull/1677)
- Add more checks for the validity of refnames by [@​facutuesca](https://togithub.com/facutuesca) in [https://github.com/gitpython-developers/GitPython/pull/1672](https://togithub.com/gitpython-developers/GitPython/pull/1672)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.36...3.1.37
### [`v3.1.36`](https://togithub.com/gitpython-developers/GitPython/compare/3.1.35...3.1.36)
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.35...3.1.36)
### [`v3.1.35`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.35): - a fix for CVE-2023-41040
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.34...3.1.35)
#### What's Changed
- Bump actions/checkout from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/gitpython-developers/GitPython/pull/1643](https://togithub.com/gitpython-developers/GitPython/pull/1643)
- Fix 'Tree' object has no attribute '\_name' when submodule path is normal path by [@​CosmosAtlas](https://togithub.com/CosmosAtlas) in [https://github.com/gitpython-developers/GitPython/pull/1645](https://togithub.com/gitpython-developers/GitPython/pull/1645)
- Fix CVE-2023-41040 by [@​facutuesca](https://togithub.com/facutuesca) in [https://github.com/gitpython-developers/GitPython/pull/1644](https://togithub.com/gitpython-developers/GitPython/pull/1644)
- Only make config more permissive in tests that need it by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1648](https://togithub.com/gitpython-developers/GitPython/pull/1648)
- Added test for PR [#​1645](https://togithub.com/gitpython-developers/GitPython/issues/1645) submodule path by [@​CosmosAtlas](https://togithub.com/CosmosAtlas) in [https://github.com/gitpython-developers/GitPython/pull/1647](https://togithub.com/gitpython-developers/GitPython/pull/1647)
- Fix Windows environment variable upcasing bug by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1650](https://togithub.com/gitpython-developers/GitPython/pull/1650)
#### New Contributors
- [@​CosmosAtlas](https://togithub.com/CosmosAtlas) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1645](https://togithub.com/gitpython-developers/GitPython/pull/1645)
- [@​facutuesca](https://togithub.com/facutuesca) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1644](https://togithub.com/gitpython-developers/GitPython/pull/1644)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.34...3.1.35
### [`v3.1.34`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.34): - fix resource leaking
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34)
#### What's Changed
- util: close lockfile after opening successfully by [@​skshetry](https://togithub.com/skshetry) in [https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)
#### New Contributors
- [@​skshetry](https://togithub.com/skshetry) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34
### [`v3.1.33`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.33): - with security fix
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33)
##### What's Changed
- WIP Quick doc by [@​LeoDaCoda](https://togithub.com/LeoDaCoda) in [https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- Partial clean up wrt mypy and black by [@​bodograumann](https://togithub.com/bodograumann) in [https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- Disable merge_includes in config writers by [@​bodograumann](https://togithub.com/bodograumann) in [https://github.com/gitpython-developers/GitPython/pull/1618](https://togithub.com/gitpython-developers/GitPython/pull/1618)
- feat: full typing for "progress" parameter in Repo class by [@​madebylydia](https://togithub.com/madebylydia) in [https://github.com/gitpython-developers/GitPython/pull/1634](https://togithub.com/gitpython-developers/GitPython/pull/1634)
- Fix CVE-2023-40590 by [@​EliahKagan](https://togithub.com/EliahKagan) in [https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
- [#​1566](https://togithub.com/gitpython-developers/GitPython/issues/1566) Creating a lock now uses python built-in "open()" method to work arou… by [@​HageMaster3108](https://togithub.com/HageMaster3108) in [https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)
##### New Contributors
- [@​LeoDaCoda](https://togithub.com/LeoDaCoda) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- [@​bodograumann](https://togithub.com/bodograumann) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- [@​EliahKagan](https://togithub.com/EliahKagan) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
- [@​HageMaster3108](https://togithub.com/HageMaster3108) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33
### [`v3.1.32`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.32): - with another security update
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32)
#### What's Changed
- Bump cygwin/cygwin-install-action from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/gitpython-developers/GitPython/pull/1572](https://togithub.com/gitpython-developers/GitPython/pull/1572)
- Fix up the commit trailers functionality by [@​itsluketwist](https://togithub.com/itsluketwist) in [https://github.com/gitpython-developers/GitPython/pull/1576](https://togithub.com/gitpython-developers/GitPython/pull/1576)
- Name top-level exceptions as private variables by [@​Hawk777](https://togithub.com/Hawk777) in [https://github.com/gitpython-developers/GitPython/pull/1590](https://togithub.com/gitpython-developers/GitPython/pull/1590)
- fix pypi long description by [@​eUgEntOptIc44](https://togithub.com/eUgEntOptIc44) in [https://github.com/gitpython-developers/GitPython/pull/1603](https://togithub.com/gitpython-developers/GitPython/pull/1603)
- Don't rely on **del** by [@​r-darwish](https://togithub.com/r-darwish) in [https://github.com/gitpython-developers/GitPython/pull/1606](https://togithub.com/gitpython-developers/GitPython/pull/1606)
- Block insecure non-multi options in clone/clone_from by [@​Beuc](https://togithub.com/Beuc) in [https://github.com/gitpython-developers/GitPython/pull/1609](https://togithub.com/gitpython-developers/GitPython/pull/1609)
#### New Contributors
- [@​Hawk777](https://togithub.com/Hawk777) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1590](https://togithub.com/gitpython-developers/GitPython/pull/1590)
- [@​eUgEntOptIc44](https://togithub.com/eUgEntOptIc44) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1603](https://togithub.com/gitpython-developers/GitPython/pull/1603)
- [@​r-darwish](https://togithub.com/r-darwish) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1606](https://togithub.com/gitpython-developers/GitPython/pull/1606)
- [@​Beuc](https://togithub.com/Beuc) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1609](https://togithub.com/gitpython-developers/GitPython/pull/1609)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32
### [`v3.1.31`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.31)
[Compare Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31)
#### What's Changed
- Fix Sphinx rendering errors by [@​stephan-cr](https://togithub.com/stephan-cr) in [https://github.com/gitpython-developers/GitPython/pull/1524](https://togithub.com/gitpython-developers/GitPython/pull/1524)
- tests: Use `command -v` instead of third-party `which` program by [@​mgorny](https://togithub.com/mgorny) in [https://github.com/gitpython-developers/GitPython/pull/1525](https://togithub.com/gitpython-developers/GitPython/pull/1525)
- fix/add allow_unsafe_\* params in docstrings + fix typo by [@​obfusk](https://togithub.com/obfusk) in [https://github.com/gitpython-developers/GitPython/pull/1530](https://togithub.com/gitpython-developers/GitPython/pull/1530)
- use tempfile.TemporaryDirectory & fix clone_from_unsafe_protocol tests by [@​obfusk](https://togithub.com/obfusk) in [https://github.com/gitpython-developers/GitPython/pull/1531](https://togithub.com/gitpython-developers/GitPython/pull/1531)
- Fix some resource leaks by open file handles by [@​marlamb](https://togithub.com/marlamb) in [https://github.com/gitpython-developers/GitPython/pull/1532](https://togithub.com/gitpython-developers/GitPython/pull/1532)
- fix files list on file rename by [@​teknoraver](https://togithub.com/teknoraver) in [https://github.com/gitpython-developers/GitPython/pull/1537](https://togithub.com/gitpython-developers/GitPython/pull/1537)
- Declare support for Python 3.11 by [@​hugovk](https://togithub.com/hugovk) in [https://github.com/gitpython-developers/GitPython/pull/1541](https://togithub.com/gitpython-developers/GitPython/pull/1541)
- Fix ignored by [@​Lightborne](https://togithub.com/Lightborne) in [https://github.com/gitpython-developers/GitPython/pull/1545](https://togithub.com/gitpython-developers/GitPython/pull/1545)
- Fix timezone parsing functions for non-hour timezones by [@​jcowgill](https://togithub.com/jcowgill) in [https://github.com/gitpython-developers/GitPython/pull/1547](https://togithub.com/gitpython-developers/GitPython/pull/1547)
- Enable user to override default diff -M arg by [@​mellowed100](https://togithub.com/mellowed100) in [https://github.com/gitpython-developers/GitPython/pull/1551](https://togithub.com/gitpython-developers/GitPython/pull/1551)
- Remove optional from two member variables by [@​Sineaggi](https://togithub.com/Sineaggi) in [https://github.com/gitpython-developers/GitPython/pull/1550](https://togithub.com/gitpython-developers/GitPython/pull/1550)
- Fix RecursionError when iterating streams by [@​eric-wieser](https://togithub.com/eric-wieser) in [https://github.com/gitpython-developers/GitPython/pull/1554](https://togithub.com/gitpython-developers/GitPython/pull/1554)
- Fix get_values() so it correctly loads section names by [@​Codym48](https://togithub.com/Codym48) in [https://github.com/gitpython-developers/GitPython/pull/1555](https://togithub.com/gitpython-developers/GitPython/pull/1555)
#### New Contributors
- [@​stephan-cr](https://togithub.com/stephan-cr) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1524](https://togithub.com/gitpython-developers/GitPython/pull/1524)
- [@​obfusk](https://togithub.com/obfusk) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1530](https://togithub.com/gitpython-developers/GitPython/pull/1530)
- [@​marlamb](https://togithub.com/marlamb) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1532](https://togithub.com/gitpython-developers/GitPython/pull/1532)
- [@​teknoraver](https://togithub.com/teknoraver) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1537](https://togithub.com/gitpython-developers/GitPython/pull/1537)
- [@​Lightborne](https://togithub.com/Lightborne) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1545](https://togithub.com/gitpython-developers/GitPython/pull/1545)
- [@​jcowgill](https://togithub.com/jcowgill) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1547](https://togithub.com/gitpython-developers/GitPython/pull/1547)
- [@​mellowed100](https://togithub.com/mellowed100) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1551](https://togithub.com/gitpython-developers/GitPython/pull/1551)
- [@​Sineaggi](https://togithub.com/Sineaggi) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1550](https://togithub.com/gitpython-developers/GitPython/pull/1550)
- [@​Codym48](https://togithub.com/Codym48) made their first contribution in [https://github.com/gitpython-developers/GitPython/pull/1555](https://togithub.com/gitpython-developers/GitPython/pull/1555)
**Full Changelog**: https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/imagecraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44Ny4yIiwidXBkYXRlZEluVmVyIjoiMzcuODcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Automatically closed by Renovate after proposing GitPython v3.1.37 to fix CVE-2023-40267 and CVE-2023-41040. With zero reviews or CI checks, the update was superseded or resolved through an alternative channel. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The GitPython security update to v3.1.37 was automatically closed by Renovate, superseded by a newer dependency update. No manual merge occurred. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate automatically closed the GitPython security update PR to v3.1.37. Enabled automerge indicates the dependency was successfully merged, or the PR was closed as obsolete. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #10 Update dependency Pygments to v2.15.0 [SECURITY] - autoclosed | imagecraft | closed | Renovate bot PR to update Pygments to v2.15.0 for CVE-2022-40896 was autoclosed without merging. No reviews or CI checks were performed. | |
| #20 Update dependency paramiko to v3 [SECURITY] - autoclosed | imagecraft | closed | Renovate pull request to update paramiko to v3.4.0 for CVE-2023-48795 was autoclosed due to inactivity. The security update was abandoned and never merged. | |
| #371 build(deps): update dependency python to 3.13 - autoclosed | starbase | closed | Automated dependency update from Python 3.10 to 3.13 was autoclosed without review or merge. The branch was inactive and automatically closed by Renovate, indicating the change was superseded or handled separately. |