Red Hat OpenStack Platform 13 (Queens)/GitPython

Red Hat · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()CVE-2026-73619 · GHSA-539M-9XH6-Q6RRVersion ranges need review.	gitpython Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	PyPIRed Hat	Medium	Fix reported	2026-09-10
GitPython vulnerable to Remote Code Execution due to improper user input validationCVE-2022-24439 · GHSA-HCPJ-QP55-GFPHVersion ranges need review.	gitpython Red Hat Ansible Automation Platform 2/python-gitpython	PyPIRed Hat	Critical	Fix reported	2026-06-10
GitPython: GitPython: Directory traversal via untrusted submodule pathCVE-2026-100689	Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Migration Toolkit for Applications 8/mta/mta-solution-server-rhel9	Red Hat	Medium	No fix reported	Not recorded
GitPython: GitPython: Information disclosure via environment variable expansion in submodule namesCVE-2026-110855	Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaiis/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
GitPython: GitPython: Arbitrary file read via argument injection in branch checkoutCVE-2026-110859	Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	Red Hat	High	No fix reported	Not recorded
GitPython: GitPython: Arbitrary file relocation via symbolic link traversal in Submodule.move()CVE-2026-110860	Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaiis/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded