[Git][security-tracker-team/security-tracker][master] New (unfortunate) batch of python-git issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5151a15e by Salvatore Bonaccorso at 2026-10-15T11:22:12+02:00
New (unfortunate) batch of python-git issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -189,17 +189,25 @@ CVE-2026-110862 (Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authent
 CVE-2026-110861 (Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 b ...)
 	NOT-FOR-US: Better Auth
 CVE-2026-110860 (GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw i ...)
-	TODO: check
+	- python-git <unfixed>
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
 CVE-2026-110859 (GitPython before 3.2.0 contains an argument injection vulnerability in ...)
-	TODO: check
+	- python-git <unfixed>
+	[trixie] - python-git <not-affected> (Incomplete fix for CVE-2026-78679 not applied)
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
+	NOTE: CVE exists because of an incomplete fir for CVE-2026-78679
 CVE-2026-110858 (GitPython from 3.1.30 before 3.2.0 contains a remote code execution vu ...)
-	TODO: check
+	- python-git <unfixed>
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239
 CVE-2026-110857 (GitPython before 3.2.0 contains a remote code execution vulnerability  ...)
-	TODO: check
+	- python-git <unfixed>
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw
 CVE-2026-110856 (GitPython before 3.2.0 contains a regular expression denial of service ...)
-	TODO: check
+	- python-git <unfixed>
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7
 CVE-2026-110855 (GitPython before 3.2.0 contains an information disclosure vulnerabilit ...)
-	TODO: check
+	- python-git <unfixed>
+	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94
 CVE-2026-110854 (Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not ha ...)
 	NOT-FOR-US: Parse Server
 CVE-2026-110853 (n8n before 1.123.83 contains an authorization bypass vulnerability tha ...)
@@ -70191,6 +70199,7 @@ CVE-2026-78679 (GitPython before 3.1.59 contains an arbitrary file read vulnerab
 	- python-git 3.1.61-1 (bug #1145672)
 	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg
 	NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6 (3.1.59)
+	NOTE: When fixing this issue make sure to fix it completely to not open up CVE-2026-110859
 CVE-2026-78678 (GitPython versions before 3.1.59 contain an incomplete denylist in the ...)
 	- python-git 3.1.61-1 (bug #1145672)
 	NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5151a15e89c4df65df8faa1051734dbb5dd4bcb0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5151a15e89c4df65df8faa1051734dbb5dd4bcb0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/ee6b7bfb/attachment.htm>