Your message dated Tue, 01 Sep 2026 00:34:10 +0000
with message-id <[email protected]>
and subject line Bug#1144344: fixed in python-git 3.1.61-1
has caused the Debian Bug report #1144344,
regarding python-git: CVE-2026-73619 CVE-2026-73620 CVE-2026-73621
CVE-2026-73622 CVE-2026-73623 CVE-2026-73624 CVE-2026-73625
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144344: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144344
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-git
Version: 3.1.50-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for python-git.
CVE-2026-73619[0]:
| GitPython before 3.1.57 contains an incomplete denylist in the
| unsafe_git_archive_options guard that omits --add-file and --add-
| virtual-file options. Attackers can supply these options to
| Repo.archive() to read arbitrary files from the filesystem and
| include them in the returned archive.
CVE-2026-73620[1]:
| GitPython before 3.1.57 fails to guard git option forwarding in
| IndexFile.checkout() and TagReference.create(), allowing attackers
| to pass unsafe options via kwargs. Attackers can use --prefix to
| overwrite arbitrary files with repository content or -F to read
| arbitrary files returned in-band.
CVE-2026-73621[2]:
| GitPython before 3.1.56 contains an argument injection vulnerability
| in the Commit.count() method, which forwards keyword arguments to
| 'git rev-list' without the check_unsafe_options guard present in the
| sibling iter_items method. An attacker who can control options
| passed to Commit.count (e.g., via an application that forwards a
| user-supplied options dict) can supply output=<path>, causing 'git
| rev-list --output=<path>' to open and truncate the target file to
| zero bytes before revision parsing. This allows destruction/blanking
| of an arbitrary file at the process's privilege level (no content
| control, 0-byte truncation).
CVE-2026-73622[3]:
| GitPython before 3.1.55 fails to disable environment variable
| expansion in Remote.create() and Submodule.add() URL handling,
| allowing attackers to exfiltrate secrets by supplying URLs
| containing variable references. Attackers can craft URLs with
| environment variable tokens that are expanded into .git/config and
| .gitmodules, then transmitted to attacker-controlled hosts during
| fetch or pull operations.
CVE-2026-73623[4]:
| GitPython before 3.1.54 contains an incomplete denylist in
| unsafe_git_clone_options that omits --template, allowing attackers
| to achieve arbitrary command execution during clone operations.
| Attackers can supply --template pointing to a directory containing
| malicious post-checkout hooks that execute when git clones the
| repository.
CVE-2026-73624[5]:
| GitPython versions before 3.1.54 contain an arbitrary file overwrite
| vulnerability in the Diffable.diff method that fails to validate git
| options passed through kwargs. Attackers can supply the --output
| argument via the other parameter or output kwarg to write patch
| content to attacker-chosen file paths at process privilege level.
CVE-2026-73625[6]:
| GitPython versions before 3.1.54 contain a remote code execution
| vulnerability in the check_unsafe_options guard that can be bypassed
| by smuggling git options inside single-character kwarg values.
| Attackers can supply crafted option dictionaries to clone_from,
| fetch, pull, push, ls_remote, iter_commits, blame, or archive
| methods to execute arbitrary OS commands via the --upload-pack
| parameter.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-73619
https://www.cve.org/CVERecord?id=CVE-2026-73619
[1] https://security-tracker.debian.org/tracker/CVE-2026-73620
https://www.cve.org/CVERecord?id=CVE-2026-73620
[2] https://security-tracker.debian.org/tracker/CVE-2026-73621
https://www.cve.org/CVERecord?id=CVE-2026-73621
[3] https://security-tracker.debian.org/tracker/CVE-2026-73622
https://www.cve.org/CVERecord?id=CVE-2026-73622
[4] https://security-tracker.debian.org/tracker/CVE-2026-73623
https://www.cve.org/CVERecord?id=CVE-2026-73623
[5] https://security-tracker.debian.org/tracker/CVE-2026-73624
https://www.cve.org/CVERecord?id=CVE-2026-73624
[6] https://security-tracker.debian.org/tracker/CVE-2026-73625
https://www.cve.org/CVERecord?id=CVE-2026-73625
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-git
Source-Version: 3.1.61-1
Done: Emmanuel Arias <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-git, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Arias <[email protected]> (supplier of updated python-git package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 21:04:23 -0300
Source: python-git
Architecture: source
Version: 3.1.61-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <[email protected]>
Changed-By: Emmanuel Arias <[email protected]>
Closes: 1143454 1143602 1144344 1144929 1145672
Changes:
python-git (3.1.61-1) unstable; urgency=high
.
* Team upload.
* New upstream version 3.1.61.
- Fix CVE-2026-67323, CVE-2026-67324, CVE-2026-67325, CVE-2026-67322,
CVE-2026-69097, CVE-2026-73623, CVE-2026-73624, CVE-2026-73625,
CVE-2026-73622, CVE-2026-73621, CVE-2026-73619, CVE-2026-73620,
CVE-2026-76217, CVE-2026-76218, CVE-2026-76219, CVE-2026-76220,
CVE-2026-76221, CVE-2026-76222, CVE-2026-78675, CVE-2026-78676,
CVE-2026-78677, CVE-2026-78678, CVE-2026-78679 (Closes: #1143454,
#1143602, #1144344, #1144929, #1145672)
* d/tests/control: Add procps to the autopkgtest dependencies.
Checksums-Sha1:
aee695ae6710f3259917dff61402c23a6cc48ffc 2798 python-git_3.1.61-1.dsc
a0d48c24a098aa3437ea3524b3095e3d65618c67 1022655 python-git_3.1.61.orig.tar.gz
5fd8979e50dbe3ce029237490547254d02b7ef6f 7332 python-git_3.1.61-1.debian.tar.xz
7a3a8741d51ab103eadec2eaa337b7e661ab7f24 8174
python-git_3.1.61-1_amd64.buildinfo
Checksums-Sha256:
4dac291bf776a187d1f211780f6e80fe36654fe3f668e8d0177b16a6c6369bb0 2798
python-git_3.1.61-1.dsc
e919636aa7a259f9d9ece36037380b70262c7b76e6e93346be13fa0c23cda997 1022655
python-git_3.1.61.orig.tar.gz
cf75d0e27114f71cfe5f61582104f9f2a5fb904a46c1f20cff60a67ce38f1062 7332
python-git_3.1.61-1.debian.tar.xz
551a06eec67c03aeb2f08ce5812206e98e20af81f0d048db5a61913a34eadc2b 8174
python-git_3.1.61-1_amd64.buildinfo
Files:
d9edf33bd778b4cc68fbba90b8a29c14 2798 python optional python-git_3.1.61-1.dsc
4b2374b7714c18ef801dea5bccb2c5f4 1022655 python optional
python-git_3.1.61.orig.tar.gz
ed9f37cb6e1b66441d9ba96a9b2411b5 7332 python optional
python-git_3.1.61-1.debian.tar.xz
25928b55bbec50f03910085555ba12dc 8174 python optional
python-git_3.1.61-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmqWF8sSHGVhbWFudUBk
ZWJpYW4ub3JnAAoJEPqd7F3hHGPx/swQAL1PlG7fMLHGnyCEG6pQLRILniXDQ3xw
aRmH2T2JxYsnKb7JoNBhCqpzqrfUGS98gA/iN+a6ZuNBypZkOPdh/hXH/WY8O3Ma
79SurPprRe+eTAT1J6oXyR+MgwuGt/nIpnD6XQWV4gjkIXurC2pejfBtDqYOTxgj
rmlY9zJOsKFNe1CEK9HkY+JsYiu5AfBm5oUbeDZiU50bpjT8ZJXWqLexMS+hCCHA
hGmnKZEUxPYjcdxbp3li2fy7y2bWvb5Ty85fWFhcMGVDiAgTeAYYa/YSHJO3k0+0
3EK3W07rbZbBjjm8iYAIupeyboocxd6ellWPoBucK4psfybpCqUGsFii0ex1UAwj
uMdrxdbOgWfD+aC+3oRPF9IIguJ63FqV2gNs+fJGKudlTU8X4TRy8D9YcG0/+/a3
EmuZ1HUtOsy+wvd1ol6r0geOwXWleYRNpANK2czzRq8Yb0hjSnn0zw/3YfCifLTr
2gT9Was29RXiVGTgjnQ2UuiaSonaTpBh1Dl0Owo6RPQCNfJDRHGUPWq/gX7h0vWQ
VAJs5fv/VsyhCOaIb76zT2YE+x1X8seW/hnnCH2aFCXKxxCOsI7N/9yEpYvktuic
6TE8y7G6YvDCgHZ0qU27N9vC6CMyTpRKw7IjIL7X65xy5en3WGf6adlL/78NP2Qr
Nmy/1wuP8Zn7
=5GyX
-----END PGP SIGNATURE-----
pgpso3pC_nh8Z.pgp
Description: PGP signature
--- End Message ---
