RHSA-2026:68764
Vulnerability from csaf_redhat - Published: 2026-09-17 20:30 - Updated: 2026-09-22 19:33Summary
Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image
Severity
Critical
Notes
Topic: A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the `_clone()` function. By crafting a malicious string in the `multi_options` parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython, a Python library used to interact with Git repositories. The `GitConfigParser.set_value()` function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the `core.hooksPath`, into a Git repository. Consequently, any Git operation that triggers hooks, such as committing or merging, could lead to arbitrary code execution from an attacker-controlled path.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in OpenSSL. A malicious TLS (Transport Layer Security) server can exploit this vulnerability by sending a specially crafted OCSP (Online Certificate Status Protocol) response during the X.509 certificate chain verification process. This can lead to a memory leak in client applications that have enabled OCSP response checking. Repeated connections to a malicious server could exhaust the client's memory, ultimately resulting in a Denial of Service (DoS).
CWE-772 - Missing Release of Resource after Effective LifetimeAffected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Low
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to overwrite arbitrary files with repository content or read sensitive files. This could result in significant data integrity and confidentiality impacts.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted to attacker-controlled hosts, leading to information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the `Diffable.diff` method, an attacker can supply a malicious output argument to write patch content to attacker-controlled file paths, leading to potential system compromise.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, and `IndexFile.merge_tree`, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path, leading to data destruction.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. A remote attacker can bypass the `check_unsafe_options` guard by combining a single-character keyword argument with `split_single_char_options=False`. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code execution on the system when a git operation is performed.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule names during repository initialization, it could lead to the creation of attacker-controlled Git repositories at arbitrary locations on the filesystem, potentially impacting system integrity.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Critical
A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the `TagReference.create()` function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as `--file=<path>`, to read arbitrary files on the system. The contents of these files are then returned within the annotated tag message, leading to information disclosure.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Moderate
A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can then place a malicious pre-commit hook in the tracked hooks directory, which executes when a victim calls index.commit() on a cloned or opened repository.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-39820
Threats
Impact
Important
References
169 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68764",
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42215",
"url": "https://access.redhat.com/security/cve/CVE-2026-42215"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42284",
"url": "https://access.redhat.com/security/cve/CVE-2026-42284"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44244",
"url": "https://access.redhat.com/security/cve/CVE-2026-44244"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54876",
"url": "https://access.redhat.com/security/cve/CVE-2026-54876"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
"url": "https://access.redhat.com/security/cve/CVE-2026-56853"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
"url": "https://access.redhat.com/security/cve/CVE-2026-56859"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73620",
"url": "https://access.redhat.com/security/cve/CVE-2026-73620"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73622",
"url": "https://access.redhat.com/security/cve/CVE-2026-73622"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73623",
"url": "https://access.redhat.com/security/cve/CVE-2026-73623"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73624",
"url": "https://access.redhat.com/security/cve/CVE-2026-73624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73625",
"url": "https://access.redhat.com/security/cve/CVE-2026-73625"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76218",
"url": "https://access.redhat.com/security/cve/CVE-2026-76218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76219",
"url": "https://access.redhat.com/security/cve/CVE-2026-76219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76220",
"url": "https://access.redhat.com/security/cve/CVE-2026-76220"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76221",
"url": "https://access.redhat.com/security/cve/CVE-2026-76221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76222",
"url": "https://access.redhat.com/security/cve/CVE-2026-76222"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-78676",
"url": "https://access.redhat.com/security/cve/CVE-2026-78676"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-78679",
"url": "https://access.redhat.com/security/cve/CVE-2026-78679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87817",
"url": "https://access.redhat.com/security/cve/CVE-2026-87817"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68764.json"
}
],
"title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image",
"tracking": {
"current_release_date": "2026-09-22T19:33:15+00:00",
"generator": {
"date": "2026-09-22T19:33:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68764",
"initial_release_date": "2026-09-17T20:30:11+00:00",
"revision_history": [
{
"date": "2026-09-17T20:30:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-17T20:30:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-22T19:33:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.18",
"product": {
"name": "Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64",
"product_id": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-vmaas-rhel9@sha256%3A9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vmaas-rhel9\u0026tag=1789611858"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64 as a component of Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-42215",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-07T19:01:30.789237+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467802"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary command execution flaw in GitPython, a library utilized across several Red Hat products. The vulnerability arises from an incomplete security check that allows specially crafted Python keyword arguments, such as `upload_pack` or `receive_pack`, to bypass intended safeguards against dangerous Git options. This bypass enables an attacker to execute arbitrary commands on systems where applications process untrusted input through GitPython\u0027s repository interaction functions, potentially leading to system compromise, credential theft, or unauthorized data modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42215"
},
{
"category": "external",
"summary": "RHBZ#2467802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42215"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42215",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42215"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"
}
],
"release_date": "2026-05-07T18:17:03.194000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks"
},
{
"cve": "CVE-2026-42284",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-07T19:01:23.592356+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467800"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the `_clone()` function. By crafting a malicious string in the `multi_options` parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in GitPython allows for arbitrary code execution during Git clone operations within Red Hat products that utilize the library. The flaw stems from insufficient validation of user-supplied input to the `_clone()` function, enabling an attacker to inject malicious Git configurations, such as `core.hooksPath`, and execute arbitrary code. Exploitation requires an application to process untrusted input through GitPython\u0027s cloning functionalities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42284"
},
{
"category": "external",
"summary": "RHBZ#2467800",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467800"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42284"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"
}
],
"release_date": "2026-05-07T18:19:20.129000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-44244",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-07T19:01:36.732863+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467804"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library used to interact with Git repositories. The `GitConfigParser.set_value()` function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the `core.hooksPath`, into a Git repository. Consequently, any Git operation that triggers hooks, such as committing or merging, could lead to arbitrary code execution from an attacker-controlled path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in GitPython that allows for arbitrary code execution. By injecting newlines into Git configuration values, an attacker can manipulate the `core.hooksPath` to execute malicious scripts during standard Git operations. This poses a significant risk in environments where applications process unvalidated user input when interacting with Git repositories, potentially leading to persistent repository configuration poisoning.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44244"
},
{
"category": "external",
"summary": "RHBZ#2467804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467804"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44244"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44244",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44244"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"
}
],
"release_date": "2026-05-07T18:22:39.704000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications that use GitPython and process untrusted input for Git configuration values must implement robust input validation and sanitization. This prevents the injection of newlines that could manipulate `core.hooksPath` and lead to arbitrary code execution. Additionally, ensure that applications interacting with Git repositories operate with the principle of least privilege to limit the potential impact of any successful exploitation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration"
},
{
"cve": "CVE-2026-54876",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-08-05T15:21:19.015952+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511600"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A malicious TLS (Transport Layer Security) server can exploit this vulnerability by sending a specially crafted OCSP (Online Certificate Status Protocol) response during the X.509 certificate chain verification process. This can lead to a memory leak in client applications that have enabled OCSP response checking. Repeated connections to a malicious server could exhaust the client\u0027s memory, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54876"
},
{
"category": "external",
"summary": "RHBZ#2511600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54876"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54876",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54876"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12",
"url": "https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638",
"url": "https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260805.txt",
"url": "https://openssl-library.org/news/secadv/20260805.txt"
}
],
"release_date": "2026-08-05T13:59:36.466000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking"
},
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
},
{
"cve": "CVE-2026-56853",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T22:14:53.561638+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515827"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56853"
},
{
"category": "external",
"summary": "RHBZ#2515827",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
},
{
"category": "external",
"summary": "https://go.dev/cl/795540",
"url": "https://go.dev/cl/795540"
},
{
"category": "external",
"summary": "https://go.dev/issue/80205",
"url": "https://go.dev/issue/80205"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-6089",
"url": "https://pkg.go.dev/vuln/GO-2026-6089"
}
],
"release_date": "2026-08-13T21:58:53.092000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
},
{
"cve": "CVE-2026-56859",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-08-13T22:16:52.493058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515840"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56859"
},
{
"category": "external",
"summary": "RHBZ#2515840",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
},
{
"category": "external",
"summary": "https://go.dev/cl/803320",
"url": "https://go.dev/cl/803320"
},
{
"category": "external",
"summary": "https://go.dev/issue/80481",
"url": "https://go.dev/issue/80481"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-6088",
"url": "https://pkg.go.dev/vuln/GO-2026-6088"
}
],
"release_date": "2026-08-13T21:58:52.959000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
},
{
"cve": "CVE-2026-73620",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-13T11:53:07.982354+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515261"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to overwrite arbitrary files with repository content or read sensitive files. This could result in significant data integrity and confidentiality impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in GitPython that allows an authenticated attacker to achieve arbitrary file overwrite and read capabilities. The vulnerability stems from insufficient validation of git options passed to `IndexFile.checkout()` and `TagReference.create()`, enabling attackers to manipulate repository content or access sensitive files. This impacts several Red Hat products, including Red Hat OpenStack Platform, Red Hat Satellite, and Red Hat Ansible Automation Platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73620"
},
{
"category": "external",
"summary": "RHBZ#2515261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73620"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read"
}
],
"release_date": "2026-08-13T11:28:21.426000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding"
},
{
"cve": "CVE-2026-73622",
"cwe": {
"id": "CWE-914",
"name": "Improper Control of Dynamically-Identified Variables"
},
"discovery_date": "2026-08-13T11:54:21.696489+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted to attacker-controlled hosts, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Information disclosure via environment variable expansion in URL handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in GitPython. It allows an attacker to exfiltrate sensitive environment variables from systems that use GitPython to create or add remote repositories from untrusted URLs. This occurs because environment variable expansion is not disabled in URL handling, leading to secrets being embedded in Git configuration and transmitted to attacker-controlled hosts.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73622"
},
{
"category": "external",
"summary": "RHBZ#2515269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73622"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73622",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73622"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2",
"url": "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add",
"url": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"
}
],
"release_date": "2026-08-13T11:28:22.807000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Information disclosure via environment variable expansion in URL handling"
},
{
"cve": "CVE-2026-73623",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T11:55:15.280313+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515275"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via malicious Git template",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in GitPython where an incomplete denylist in `unsafe_git_clone_options` allows remote code execution. An attacker can leverage the `--template` option to execute arbitrary commands during repository cloning by pointing to a directory containing malicious post-checkout hooks. This risk is present when applications using GitPython clone untrusted repositories.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73623"
},
{
"category": "external",
"summary": "RHBZ#2515275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515275"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73623"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73623",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73623"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template"
}
],
"release_date": "2026-08-13T11:28:23.477000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via malicious Git template"
},
{
"cve": "CVE-2026-73624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-13T11:51:01.223720+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the `Diffable.diff` method, an attacker can supply a malicious output argument to write patch content to attacker-controlled file paths, leading to potential system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary File Overwrite via improper git option validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary file overwrite vulnerability in GitPython\u0027s Diffable.diff method. It allows an attacker to write arbitrary content to chosen file paths at the process\u0027s privilege level by manipulating git options, which could lead to system compromise or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73624"
},
{
"category": "external",
"summary": "RHBZ#2515243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73624"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff"
}
],
"release_date": "2026-08-13T11:28:24.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary File Overwrite via improper git option validation"
},
{
"cve": "CVE-2026-73625",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T11:54:49.542600+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515272"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via kwarg value smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote code execution vulnerability in GitPython, affecting Red Hat products that utilize GitPython versions prior to 3.1.54. The flaw allows an attacker to bypass input sanitization by smuggling malicious Git options within single-character keyword arguments, leading to arbitrary command execution when GitPython methods process untrusted input. This poses a significant risk to the integrity and confidentiality of systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73625"
},
{
"category": "external",
"summary": "RHBZ#2515272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515272"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73625"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling"
}
],
"release_date": "2026-08-13T11:28:24.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via kwarg value smuggling"
},
{
"cve": "CVE-2026-76218",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:37.531853+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519603"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via malicious Git hooks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s Repo.init forwards an unvalidated template parameter, letting an attacker who controls that parameter point at a directory of malicious git hooks that execute on subsequent git operations (RCE), fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose the Repo.init template/options parameters to adversary-controlled input; the vulnerable parameter cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76218"
},
{
"category": "external",
"summary": "RHBZ#2519603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76218"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"
}
],
"release_date": "2026-08-19T14:02:02.729000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython\u0027s Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via malicious Git hooks"
},
{
"cve": "CVE-2026-76219",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:07.494177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519597"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, and `IndexFile.merge_tree`, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path, leading to data destruction.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree append caller-influenced treeish strings to `git read-tree` without option validation or argument separation, letting an attacker who controls those arguments inject the `--index-output` option to overwrite arbitrary files at attacker-controlled writable paths (data destruction), fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these IndexFile treeish arguments to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76219"
},
{
"category": "external",
"summary": "RHBZ#2519597",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519597"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76219"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"
}
],
"release_date": "2026-08-19T14:02:03.425000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced treeish arguments to GitPython\u0027s IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree. Upgrade to GitPython 3.1.58 or later, where option injection into `git read-tree` is fixed.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection"
},
{
"cve": "CVE-2026-76220",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-19T14:13:21.277967+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519610"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. A remote attacker can bypass the `check_unsafe_options` guard by combining a single-character keyword argument with `split_single_char_options=False`. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary command execution via crafted kwargs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s check_unsafe_options guard can be bypassed by combining a single-character keyword argument with split_single_char_options=False, letting an attacker who supplies a crafted kwargs dictionary to guarded methods such as clone_from emit a joined token parsed as `--upload-pack` and achieve arbitrary OS command execution even at the default allow_unsafe_options=False, fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these method keyword arguments to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76220"
},
{
"category": "external",
"summary": "RHBZ#2519610",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519610"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76220"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76220",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76220"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options",
"url": "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"
}
],
"release_date": "2026-08-19T14:02:04.108000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced keyword arguments to GitPython\u0027s guarded methods such as clone_from, and do not set split_single_char_options=False on untrusted input. Upgrade to GitPython 3.1.58 or later, where the check_unsafe_options bypass is fixed.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary command execution via crafted kwargs"
},
{
"cve": "CVE-2026-76221",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:02.928636+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519596"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code execution on the system when a git operation is performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary code execution via config-name injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s option-name validator fails to neutralize equals signs, hash symbols, and whitespace in option names, letting an attacker who controls option names forge arbitrary git-config directives (e.g. `sshCommand = touch /tmp/RCE #`) that execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation, fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose git option names to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76221"
},
{
"category": "external",
"summary": "RHBZ#2519596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76221"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name",
"url": "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name"
}
],
"release_date": "2026-08-19T14:02:04.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced git option names to GitPython. Upgrade to GitPython 3.1.58 or later, where option-name (config) injection is fixed.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary code execution via config-name injection"
},
{
"cve": "CVE-2026-76222",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-19T14:13:14.104704+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519609"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule names during repository initialization, it could lead to the creation of attacker-controlled Git repositories at arbitrary locations on the filesystem, potentially impacting system integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2026-76222 is a path-traversal flaw in GitPython submodule handling: cloning a malicious repository and initializing its submodules can create files or repositories outside the intended directory, because GitPython omits the suspicious-submodule-name guard that upstream core git enforces. Unlike the caller-gated GitPython option-forwarding flaws, this triggers during ordinary clone plus submodule initialization of an untrusted repository, so any Red Hat product that ships or bundles a vulnerable GitPython version is affected. Fixed in GitPython 3.1.58.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76222"
},
{
"category": "external",
"summary": "RHBZ#2519609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519609"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76222"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76222",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76222"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name",
"url": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"
}
],
"release_date": "2026-08-19T14:02:05.596000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "There is no mitigation beyond not cloning or initializing git submodules from untrusted repositories. Upgrade to GitPython 3.1.58 or later when it becomes available.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names"
},
{
"cve": "CVE-2026-78676",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-25T01:52:20.869828+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523197"
}
],
"notes": [
{
"category": "description",
"text": "GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Case for AC:H (8.1): the trigger needs two things the attacker does not\n straightforwardly own:\n (1) a crafted multi-line quoted value must already sit DORMANT in .git/config\n \u2014 the guarded set_value() path will not put it there; it must arrive via\n _read() of a file the attacker influenced but does not directly write; and\n (2) a SUBSEQUENT, UNRELATED GitPython config WRITE must fire to re-serialize\n and corrupt it \u2014 and that write is performed by the victim application on\n its own schedule, not by the attacker. \n \"Prepare the target environment\" + \"conditions beyond the attacker\u0027s control\"\n is the textbook AC:H definition; step (2) in particular fits it.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-78676"
},
{
"category": "external",
"summary": "RHBZ#2523197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-78676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78676"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"
}
],
"release_date": "2026-08-25T01:30:33.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection"
},
{
"cve": "CVE-2026-78679",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-25T01:52:49.105310+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523205"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the `TagReference.create()` function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as `--file=\u003cpath\u003e`, to read arbitrary files on the system. The contents of these files are then returned within the annotated tag message, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary file read via TagReference.create()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in GitPython\u0027s TagReference.create() function. An incomplete fix for a prior vulnerability (GHSA-3f7w-8rr8-f37f) failed to validate positional parameters, allowing an attacker with low privileges to supply a specially crafted reference value (such as --file=/path/to/file) to read arbitrary files on the system. The file contents are then returned within the annotated tag message, leading to information disclosure. This vulnerability requires that the application forwards user-controlled input to the reference parameter of TagReference.create(), which limits the scope of exploitation to applications that expose this specific code path.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-78679"
},
{
"category": "external",
"summary": "RHBZ#2523205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-78679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78679"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"
}
],
"release_date": "2026-08-25T01:30:36.339000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. For additional information, refer to the upstream advisory at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "GitPython: GitPython: Arbitrary file read via TagReference.create()"
},
{
"cve": "CVE-2026-87817",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-09-09T11:31:36.011888+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530744"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can then place a malicious pre-commit hook in the tracked hooks directory, which executes when a victim calls index.commit() on a cloned or opened repository.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Remote Code Execution via Git directory impersonation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because it allows remote code execution in Red Hat products utilizing GitPython. Exploitation requires user interaction, specifically a victim calling index.commit() on a repository where an attacker has previously placed a malicious pre-commit hook by impersonating the git directory. This reduces the immediate threat compared to vulnerabilities exploitable without user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87817"
},
{
"category": "external",
"summary": "RHBZ#2530744",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530744"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87817"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",
"url": "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"
}
],
"release_date": "2026-09-09T11:21:04.007000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:30:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68764"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:9dc5a13c4d75f07c2c3df2cd276c49f172224bd9b472babf5170eaf8d4652816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Remote Code Execution via Git directory impersonation"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…