{
  "threat_severity" : "Moderate",
  "public_date" : "2023-08-11T00:00:00Z",
  "bugzilla" : {
    "description" : "GitPython: Insecure non-multi options in clone and clone_from is not blocked",
    "id" : "2231474",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2231474"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-20",
  "details" : [ "GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.", "An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution." ],
  "statement" : "In Red Hat Openstack, Red Hat Ansible Automation Platform, and Red Hat Certification Program, while the gitpython dependency is present, the affected codebase is not being used. \nRed Hat Satellite does not use the affected functions during runtime, therefore the possible impact is limited to Moderate.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 2.3 for RHEL 8",
    "release_date" : "2023-09-06T00:00:00Z",
    "advisory" : "RHSA-2023:4991",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.3::el8",
    "package" : "automation-controller-0:4.3.13-1.el8ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.3 for RHEL 9",
    "release_date" : "2023-09-06T00:00:00Z",
    "advisory" : "RHSA-2023:4991",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.3::el9",
    "package" : "automation-controller-0:4.3.13-1.el9ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "release_date" : "2023-09-05T00:00:00Z",
    "advisory" : "RHSA-2023:4971",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
    "package" : "automation-controller-0:4.4.3-1.el8ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "release_date" : "2023-09-05T00:00:00Z",
    "advisory" : "RHSA-2023:4971",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
    "package" : "python3x-gitpython-0:3.1.32-1.el8ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "release_date" : "2023-09-05T00:00:00Z",
    "advisory" : "RHSA-2023:4971",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
    "package" : "automation-controller-0:4.4.3-1.el9ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "release_date" : "2023-09-05T00:00:00Z",
    "advisory" : "RHSA-2023:4971",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
    "package" : "python-gitpython-0:3.1.32-1.el9ap",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Satellite 6.13 for RHEL 8",
    "release_date" : "2023-10-19T00:00:00Z",
    "advisory" : "RHSA-2023:5931",
    "cpe" : "cpe:/a:redhat:satellite:6.13::el8",
    "package" : "python-gitpython-0:3.1.32-1.el8pc",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Satellite 6.13 for RHEL 8",
    "release_date" : "2023-10-19T00:00:00Z",
    "advisory" : "RHSA-2023:5931",
    "cpe" : "cpe:/a:redhat:satellite_capsule:6.13::el8",
    "package" : "python-gitpython-0:3.1.32-1.el8pc",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Satellite 6.14 for RHEL 8",
    "release_date" : "2023-11-08T00:00:00Z",
    "advisory" : "RHSA-2023:6818",
    "cpe" : "cpe:/a:redhat:satellite:6.14::el8",
    "package" : "python-gitpython-0:3.1.32-1.el8pc",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Satellite 6.14 for RHEL 8",
    "release_date" : "2023-11-08T00:00:00Z",
    "advisory" : "RHSA-2023:6818",
    "cpe" : "cpe:/a:redhat:satellite_capsule:6.14::el8",
    "package" : "python-gitpython-0:3.1.32-1.el8pc",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 1.2",
    "fix_state" : "Not affected",
    "package_name" : "gitpython",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Tower 3",
    "fix_state" : "Affected",
    "package_name" : "gitpython",
    "cpe" : "cpe:/a:redhat:ansible_tower:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Certification for Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "redhat-certification-backend",
    "cpe" : "cpe:/a:redhat:certifications:1::el6",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Certification for Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "redhat-certification",
    "cpe" : "cpe:/a:redhat:certifications:1::el7",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Certification for Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "redhat-certification",
    "cpe" : "cpe:/a:redhat:certifications:1::el8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Certification Program for Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "redhat-certification",
    "cpe" : "cpe:/a:redhat:certifications:9",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.1",
    "fix_state" : "Fix deferred",
    "package_name" : "GitPython",
    "cpe" : "cpe:/a:redhat:openstack:16.1",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Fix deferred",
    "package_name" : "GitPython",
    "cpe" : "cpe:/a:redhat:openstack:16.2",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.0",
    "fix_state" : "Fix deferred",
    "package_name" : "GitPython",
    "cpe" : "cpe:/a:redhat:openstack:17.0",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.1",
    "fix_state" : "Fix deferred",
    "package_name" : "GitPython",
    "cpe" : "cpe:/a:redhat:openstack:17.1",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 18.0",
    "fix_state" : "Not affected",
    "package_name" : "GitPython",
    "cpe" : "cpe:/a:redhat:openstack:18.0",
    "impact" : "low"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-40267\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40267\nhttps://github.com/advisories/GHSA-pr76-5cm5-w9cj" ],
  "name" : "CVE-2023-40267",
  "csaw" : false
}