Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
GitPython in Red Hat OpenStack Platform 17.1: Privilege Escalation Risk
published 2 years ago
Summary
A security update is available for Red Hat OpenStack Platform 17.1, which includes a fix for a vulnerability in GitPython that could allow an attacker to gain elevated privileges. This update is important for organizations using OpenStack Platform to ensure the security and integrity of their infrastructure. We recommend applying the update as soon as possible to minimize potential risks.
What to do
- Update redhat gitpython to version 0:3.1.14-2.el8ost.
- Update redhat python3-gitpython to version 0:3.1.14-2.el8ost.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:openstack:17.1::el8 | redhat | gitpython |
< 0:3.1.14-2.el8ost Fix: upgrade to 0:3.1.14-2.el8ost
|
| Red Hat:openstack:17.1::el8 | redhat | python3-gitpython |
< 0:3.1.14-2.el8ost Fix: upgrade to 0:3.1.14-2.el8ost
|
Original advisory text
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (GitPython) security update
References
- https://access.redhat.com/errata/RHSA-2024:0190 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2247040 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0190.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-41040 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-41040 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-41040 Vendor Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Sep 2024
Updated10 Jun 2026
First seen10 Jun 2026
Sources
RHSA-2024:0190 · OSV
Track software like this
Free during beta