Vulnerability-Lookup

usn-8303-1

Vulnerability from osv_ubuntu

Published

2026-05-26 21:52

Modified

2026-05-26 21:52

Summary

python-git vulnerabilities

Details

Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git references. An attacker could possibly use this issue to cause files outside the .git directory to be accessed, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-41040)

Wes Ring discovered that GitPython did not properly block certain unsafe Git options when they were provided as Python keyword arguments. An attacker could possibly use this issue to cause arbitrary command execution. (CVE-2026-42215)

It was discovered that GitPython did not properly validate clone options before processing them. An attacker could possibly use this issue to inject unsafe Git configuration, leading to arbitrary command execution through Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)

It was discovered that GitPython did not properly validate reference paths during reference operations. An attacker could possibly use this issue to write, overwrite, move, or delete files outside the repository. (CVE-2026-44243)

Dan Aridor discovered that GitPython did not properly validate configuration values before writing them to Git configuration files. An attacker could possibly use this issue to inject unsafe Git configuration, leading to arbitrary command execution through Git hooks. (CVE-2026-44244)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-41040	REPORT
	https://ubuntu.com/security/CVE-2026-42215	REPORT
	https://ubuntu.com/security/CVE-2026-42284	REPORT
	https://ubuntu.com/security/CVE-2026-44243	REPORT
	https://ubuntu.com/security/CVE-2026-44244	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41040",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@0.3.2~RC1-3ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2~RC1-3ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.2~RC1-2",
        "0.3.2~RC1-3",
        "0.3.2~RC1-3ubuntu0.1~esm1",
        "0.3.2~RC1-3ubuntu0.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41040",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1+git137-gc8b8379-1",
        "1.0.1+git137-gc8b8379-2",
        "1.0.1+git137-gc8b8379-2.1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41040",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@2.1.8-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.8-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1",
        "2.1.6-1",
        "2.1.7-1",
        "2.1.8-1",
        "2.1.8-1ubuntu0.1~esm1",
        "2.1.8-1ubuntu0.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41040",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42284",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41040",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42284",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42284",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.37-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.37-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.37-3ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.30-1",
        "3.1.37-1",
        "3.1.37-3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-42215",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-42284",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44243",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44244",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.46-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.46-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.46-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1",
        "3.1.45-1",
        "3.1.46-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Santos Gallegos discovered that GitPython did not properly validate\npaths when resolving certain Git references. An attacker could possibly\nuse this issue to cause files outside the .git directory to be accessed,\nleading to a denial of service. This issue only affected Ubuntu 14.04\nLTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu\n22.04 LTS. (CVE-2023-41040)\n\nWes Ring discovered that GitPython did not properly block certain unsafe\nGit options when they were provided as Python keyword arguments. An\nattacker could possibly use this issue to cause arbitrary command\nexecution. (CVE-2026-42215)\n\nIt was discovered that GitPython did not properly validate clone options\nbefore processing them. An attacker could possibly use this issue to\ninject unsafe Git configuration, leading to arbitrary command execution\nthrough Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)\n\nIt was discovered that GitPython did not properly validate reference\npaths during reference operations. An attacker could possibly use this\nissue to write, overwrite, move, or delete files outside the repository.\n(CVE-2026-44243)\n\nDan Aridor discovered that GitPython did not properly validate\nconfiguration values before writing them to Git configuration files. An\nattacker could possibly use this issue to inject unsafe Git\nconfiguration, leading to arbitrary command execution through Git hooks.\n(CVE-2026-44244)",
  "id": "USN-8303-1",
  "modified": "2026-05-26T21:52:45Z",
  "published": "2026-05-26T21:52:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41040"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-42215"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-42284"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44243"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44244"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "python-git vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-41040",
    "UBUNTU-CVE-2026-42215",
    "UBUNTU-CVE-2026-42284",
    "UBUNTU-CVE-2026-44243",
    "UBUNTU-CVE-2026-44244"
  ]
}

ubuntu-cve-2023-41040

Vulnerability from osv_ubuntu

Published

2023-08-30 22:15

Modified

2026-05-27 10:03

Summary

Details

GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the .git directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

Severity

4.0 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-41040	REPORT
	https://github.com/gitpython-developers/GitPython…	REPORT
	https://github.com/gitpython-developers/GitPython…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2023-41040	REPORT
	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@0.3.2~RC1-3ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2~RC1-3ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.2~RC1-2",
        "0.3.2~RC1-3",
        "0.3.2~RC1-3ubuntu0.1~esm1",
        "0.3.2~RC1-3ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1+git137-gc8b8379-1",
        "1.0.1+git137-gc8b8379-2",
        "1.0.1+git137-gc8b8379-2.1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@2.1.8-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.8-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1",
        "2.1.6-1",
        "2.1.7-1",
        "2.1.8-1",
        "2.1.8-1ubuntu0.1~esm1",
        "2.1.8-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    }
  ],
  "aliases": [],
  "details": "GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn\u0027t check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.",
  "id": "UBUNTU-CVE-2023-41040",
  "modified": "2026-05-27T10:03:14Z",
  "published": "2023-08-30T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41040"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41040"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    }
  ],
  "related": [
    "USN-8303-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-41040"
  ]
}

ubuntu-cve-2026-42215

Vulnerability from osv_ubuntu

Published

2026-05-07 19:16

Modified

2026-05-27 10:05

Summary

Details

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-42215	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-42215	REPORT
	https://github.com/gitpython-developers/GitPython…	REPORT
	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@0.3.2~RC1-3ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2~RC1-3ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.2~RC1-2",
        "0.3.2~RC1-3",
        "0.3.2~RC1-3ubuntu0.1~esm1",
        "0.3.2~RC1-3ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1+git137-gc8b8379-1",
        "1.0.1+git137-gc8b8379-2",
        "1.0.1+git137-gc8b8379-2.1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@2.1.8-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.8-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1",
        "2.1.6-1",
        "2.1.7-1",
        "2.1.8-1",
        "2.1.8-1ubuntu0.1~esm1",
        "2.1.8-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.37-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.37-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.37-3ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.30-1",
        "3.1.37-1",
        "3.1.37-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.44-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.44-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.46-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.46-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.46-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1",
        "3.1.45-1",
        "3.1.46-1"
      ]
    }
  ],
  "aliases": [],
  "details": "GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.",
  "id": "UBUNTU-CVE-2026-42215",
  "modified": "2026-05-27T10:05:32Z",
  "published": "2026-05-07T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-42215"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42215"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    }
  ],
  "related": [
    "USN-8303-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-42215"
  ]
}

ubuntu-cve-2026-42284

Vulnerability from osv_ubuntu

Published

2026-05-07 19:16

Modified

2026-05-27 10:05

Summary

Details

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-42284	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-42284	REPORT
	https://github.com/gitpython-developers/GitPython…	REPORT
	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.37-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.37-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.37-3ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.30-1",
        "3.1.37-1",
        "3.1.37-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.44-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.44-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.46-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.46-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.46-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1",
        "3.1.45-1",
        "3.1.46-1"
      ]
    }
  ],
  "aliases": [],
  "details": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.",
  "id": "UBUNTU-CVE-2026-42284",
  "modified": "2026-05-27T10:05:32Z",
  "published": "2026-05-07T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-42284"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42284"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    }
  ],
  "related": [
    "USN-8303-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-42284"
  ]
}

ubuntu-cve-2026-44243

Vulnerability from osv_ubuntu

Published

2026-05-07 19:16

Modified

2026-05-27 10:05

Summary

Details

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

Severity

7.8 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

7.1 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-44243	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-44243	REPORT
	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@0.3.2~RC1-3ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2~RC1-3ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.2~RC1-2",
        "0.3.2~RC1-3",
        "0.3.2~RC1-3ubuntu0.1~esm1",
        "0.3.2~RC1-3ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1+git137-gc8b8379-1",
        "1.0.1+git137-gc8b8379-2",
        "1.0.1+git137-gc8b8379-2.1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@2.1.8-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.8-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1",
        "2.1.6-1",
        "2.1.7-1",
        "2.1.8-1",
        "2.1.8-1ubuntu0.1~esm1",
        "2.1.8-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.37-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.37-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.37-3ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.30-1",
        "3.1.37-1",
        "3.1.37-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.44-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.44-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.46-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.46-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.46-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1",
        "3.1.45-1",
        "3.1.46-1"
      ]
    }
  ],
  "aliases": [],
  "details": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository\u2019s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.",
  "id": "UBUNTU-CVE-2026-44243",
  "modified": "2026-05-27T10:05:32Z",
  "published": "2026-05-07T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44243"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44243"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    }
  ],
  "related": [
    "USN-8303-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-44243"
  ]
}

ubuntu-cve-2026-44244

Vulnerability from osv_ubuntu

Published

2026-05-07 19:16

Modified

2026-05-27 10:05

Summary

Details

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-44244	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-44244	REPORT
	https://ubuntu.com/security/notices/USN-8303-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@0.3.2~RC1-3ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2~RC1-3ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.2~RC1-2",
        "0.3.2~RC1-3",
        "0.3.2~RC1-3ubuntu0.1~esm1",
        "0.3.2~RC1-3ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1+git137-gc8b8379-1",
        "1.0.1+git137-gc8b8379-2",
        "1.0.1+git137-gc8b8379-2.1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
        "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          },
          {
            "binary_name": "python3-git",
            "binary_version": "2.1.8-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@2.1.8-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.8-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1",
        "2.1.6-1",
        "2.1.7-1",
        "2.1.8-1",
        "2.1.8-1ubuntu0.1~esm1",
        "2.1.8-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.0.7-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.0.7-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7-1ubuntu0.1~esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.11-1",
        "3.0.4-1",
        "3.0.5-1",
        "3.0.7-1",
        "3.0.7-1ubuntu0.1~esm1",
        "3.0.7-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.24-1ubuntu0.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.24-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.24-1ubuntu0.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.14-1",
        "3.1.23-1",
        "3.1.24-1",
        "3.1.24-1ubuntu0.1~esm1",
        "3.1.24-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.37-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.37-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.37-3ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.30-1",
        "3.1.37-1",
        "3.1.37-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.44-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.44-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-git",
            "binary_version": "3.1.46-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "python-git",
        "purl": "pkg:deb/ubuntu/python-git@3.1.46-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.46-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.44-1",
        "3.1.45-1",
        "3.1.46-1"
      ]
    }
  ],
  "aliases": [],
  "details": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python\u0027s configparser without validating for newlines. GitPython\u0027s own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header \u2014 so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.",
  "id": "UBUNTU-CVE-2026-44244",
  "modified": "2026-05-27T10:05:32Z",
  "published": "2026-05-07T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44244"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44244"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8303-1"
    }
  ],
  "related": [
    "USN-8303-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-44244"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-8303-1

Vulnerability from osv_ubuntu

ubuntu-cve-2023-41040

Vulnerability from osv_ubuntu

ubuntu-cve-2026-42215

Vulnerability from osv_ubuntu

ubuntu-cve-2026-42284

Vulnerability from osv_ubuntu

ubuntu-cve-2026-44243

Vulnerability from osv_ubuntu

ubuntu-cve-2026-44244

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature