search

ishepard / pydriller

Python Framework to analyse Git repositories
http://pydriller.readthedocs.io/en/latest/
Apache License 2.0
809 stars 139 forks source link

GitPython 3.1.30 dependency is vulnerable to RCE CVE-2023-40267 #280

Closed behnazh-w closed 9 months ago

behnazh-w commented 9 months ago

The GitPython dependency, which is pinned to 3.1.30 is vulnerable to a Remote Code Execution attack and needs to be updated to version 3.1.32.

Unfortunately, the packages that use pydriller are now forced to ship the vulnerable GitPython, which is not acceptable. Can you please give a timeline when you plan to fix this issue?

See CVE details here: https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj

ishepard commented 9 months ago

Hi! Unfortunately newer versions of GitPython do not use properly git stat, which breaks many functions in Pydriller. I opened an issue some time ago: https://github.com/gitpython-developers/GitPython/issues/1556

We don't have a fix yet, I'll have to work on it, or someone from the community maybe

ishepard commented 9 months ago

New version with GitPython published. Closing this issue. Thanks!