GitPython 3.1.30 dependency is vulnerable to RCE CVE-2023-40267

Question

GitPython 3.1.30 dependency is vulnerable to RCE CVE-2023-40267

behnazh-w opened this issue 10 months ago · comments

Behnaz Hassanshahi commented 10 months ago

The GitPython dependency, which is pinned to 3.1.30 is vulnerable to a Remote Code Execution attack and needs to be updated to version 3.1.32.

Unfortunately, the packages that use pydriller are now forced to ship the vulnerable GitPython, which is not acceptable. Can you please give a timeline when you plan to fix this issue?

See CVE details here: https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj

Davide Spadini · Answer 1 · Mon Aug 14 2023 22:26:20 GMT+0800 (China Standard Time)

Hi! Unfortunately newer versions of GitPython do not use properly git stat, which breaks many functions in Pydriller. I opened an issue some time ago: gitpython-developers/GitPython#1556

We don't have a fix yet, I'll have to work on it, or someone from the community maybe

Davide Spadini · Answer 2 · Mon Aug 21 2023 18:54:23 GMT+0800 (China Standard Time)

New version with GitPython published. Closing this issue.
Thanks!