Matched advisory candidates (shard 15)

advisories/BREW-animdl-CVE-2025-43859.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-animdl-CVE-2025-43859",
   "published": "2026-08-13T16:35:16Z",
-  "modified": "2026-10-07T23:36:48Z",
+  "modified": "2026-10-29T21:29:49Z",
   "upstream": [
     "GHSA-vqfr-h8mv-ghfj",
     "CVE-2025-43859",
@@ -70,9 +70,17 @@
       "type": "WEB",
       "url": "https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/h11/PYSEC-2026-348.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/python-hyper/h11"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pypi.org/project/h11"
     }
   ]
 }

advisories/BREW-conda-lock-CVE-2023-40267.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2023-40267",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-10-12T17:39:45Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-pr76-5cm5-w9cj",
     "CVE-2023-40267",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "3.1.32",
         "resource": "gitpython",
-        "resource_purl": "pkg:pypi/gitpython@3.2.0"
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "gitpython",
-        "subject_version": "3.2.0",
-        "key": "pkg:pypi/gitpython@3.2.0",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
         "resource": "gitpython"
       }
     ]

advisories/BREW-conda-lock-CVE-2023-40590.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2023-40590",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-10-12T17:39:45Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-wfm5-v35h-vwf4",
     "CVE-2023-40590",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "3.1.33",
         "resource": "gitpython",
-        "resource_purl": "pkg:pypi/gitpython@3.2.0"
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "gitpython",
-        "subject_version": "3.2.0",
-        "key": "pkg:pypi/gitpython@3.2.0",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
         "resource": "gitpython"
       }
     ]

advisories/BREW-conda-lock-CVE-2023-41040.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2023-41040",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-10-12T17:39:45Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-cwvm-v4w8-q58c",
     "CVE-2023-41040",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "3.1.37",
         "resource": "gitpython",
-        "resource_purl": "pkg:pypi/gitpython@3.2.0"
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "gitpython",
-        "subject_version": "3.2.0",
-        "key": "pkg:pypi/gitpython@3.2.0",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
         "resource": "gitpython"
       }
     ]

advisories/BREW-conda-lock-CVE-2024-22190.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2024-22190",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-10-12T17:39:45Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-2mqj-m65w-jghx",
     "CVE-2024-22190",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "3.1.41",
         "resource": "gitpython",
-        "resource_purl": "pkg:pypi/gitpython@3.2.0"
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "gitpython",
-        "subject_version": "3.2.0",
-        "key": "pkg:pypi/gitpython@3.2.0",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
         "resource": "gitpython"
       }
     ]

advisories/BREW-conda-lock-CVE-2024-6345.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2024-6345",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-10-07T23:37:00Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-cx63-2mw6-8hw5",
     "BIT-setuptools-2024-6345",
@@ -34,7 +34,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "70.0.0",
         "resource": "setuptools",
-        "resource_purl": "pkg:pypi/setuptools@84.0.0"
+        "resource_purl": "pkg:pypi/setuptools@84.2.1"
       }
     }
   ],
@@ -47,8 +47,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "setuptools",
-        "subject_version": "84.0.0",
-        "key": "pkg:pypi/setuptools@84.0.0",
+        "subject_version": "84.2.1",
+        "key": "pkg:pypi/setuptools@84.2.1",
         "resource": "setuptools"
       }
     ]

advisories/BREW-conda-lock-CVE-2025-47273.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2025-47273",
   "published": "2026-08-13T16:41:05Z",
-  "modified": "2026-09-17T18:12:38Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-5rjg-fvgr-3xxf",
     "BIT-setuptools-2025-47273",
@@ -34,7 +34,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "78.1.1",
         "resource": "setuptools",
-        "resource_purl": "pkg:pypi/setuptools@84.0.0"
+        "resource_purl": "pkg:pypi/setuptools@84.2.1"
       }
     }
   ],
@@ -47,8 +47,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "setuptools",
-        "subject_version": "84.0.0",
-        "key": "pkg:pypi/setuptools@84.0.0",
+        "subject_version": "84.2.1",
+        "key": "pkg:pypi/setuptools@84.2.1",
         "resource": "setuptools"
       }
     ]

advisories/BREW-conda-lock-CVE-2026-100689.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-conda-lock-CVE-2026-100689",
   "published": "2026-10-01T09:14:40Z",
-  "modified": "2026-10-12T17:39:45Z",
+  "modified": "2026-10-29T21:39:28Z",
   "upstream": [
     "GHSA-59cr-6r3x-644w",
     "CVE-2026-100689"
@@ -32,7 +32,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "3.1.62",
         "resource": "gitpython",
-        "resource_purl": "pkg:pypi/gitpython@3.2.0"
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
       }
     }
   ],
@@ -45,8 +45,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "gitpython",
-        "subject_version": "3.2.0",
-        "key": "pkg:pypi/gitpython@3.2.0",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
         "resource": "gitpython"
       }
     ]

advisories/BREW-conda-lock-CVE-2026-110855.json

@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-conda-lock-CVE-2026-110855",
+  "published": "2026-10-29T21:39:28Z",
+  "modified": "2026-10-29T21:39:28Z",
+  "upstream": [
+    "GHSA-fx3j-rwgx-fr94",
+    "CVE-2026-110855"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "conda-lock",
+        "purl": "pkg:brew/conda-lock"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "4.0.3"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.2.0",
+        "resource": "gitpython",
+        "resource_purl": "pkg:pypi/gitpython@3.2.1"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "registry",
+    "confidence": "high",
+    "upstream_evidence": [
+      {
+        "strategy": "registry",
+        "ecosystem": "PyPI",
+        "name": "gitpython",
+        "subject_version": "3.2.1",
+        "key": "pkg:pypi/gitpython@3.2.1",
+        "resource": "gitpython"
+      }
+    ]
+  },
+  "summary": "GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name",
+  "details": "### Summary\n`Repo._clone()`'s handling of `separate_git_dir` never disables `Git.polish_url()`'s environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since `separate_git_dir` can be derived from an attacker-controlled `.gitmodules` submodule name, a completely ordinary `clone` + `submodule_update(init=True, recursive=True)` on a malicious repository expands an environment variable of the attacker's choosing and exposes its value both as a persistent on-disk directory name and, whenever DEBUG-level logging is enabled (a common CI/verbose-logging configuration), in a `Popen(...)` log line that is not redacted the way credential-bearing arguments are.\n\n### Root cause / Details\n`git/repo/base.py`'s `_clone()` has:\n\n```python\nsep_dir = kwargs.get(\"separate_git_dir\")\nif sep_dir:\n    kwargs[\"separate_git_dir\"] = Git.polish_url(sep_dir)\n```\n\nThis is the only remaining `Git.polish_url()` call site handling attacker-influenced data that does not pass `expand_vars=False` (there is one other unguarded call site, `clone_path` at line 1537, but its input is the caller's own local destination path, not attacker-controlled). The sibling fixes for `GHSA-94p4-4cq8-9g67`/`GHSA-rwj8-pgh3-r573` added `expand_vars=False` to `clone_url` (5 lines below this one, in the same function), `git/repo/base.py:1599`, `remote.py:814`, and `submodule/base.py:686` — this one did not receive it. (`submodule/root.py` also currently sets `expand_vars=False` at a related call site, but that was added incidentally by a later, unrelated commit, not as part of these security fixes.) `Git.polish_url()`'s docstring itself says: \"Disable this for values obtained from an untrusted source, such as remote URLs.\" Its non-Cygwin branch does plain `os.path.expandvars()` on the entire string, including embedded variables anywhere in an absolute path.\n\n`separate_git_dir` reaches `_clone()` from `Submodule._clone_repo()` (`git/objects/submodule/base.py`) as `module_abspath = osp.join(parent_repo.git_dir, \"modules\", name)`, where `name` is the raw `.gitmodules` submodule section name — fully attacker-controlled content of a cloned repository. `_validated_name()` (added by the fix for `GHSA-hmq2-w58f-27jc`) only rejects names that are absolute, contain a drive letter, or contain `..` path components; it does not reject `$`. `_need_gitfile_submodules()` is true for git ≥ 1.7.5, i.e. the default path for virtually every real-world installation.\n\n### Reproduction (live, against real, unmodified GitPython code, no monkeypatching)\nBuilt a hostile repository with a plain, ordinary git command: `git submodule add --name '$GPY_SECRET_MARKER' ../evil_submodule sub`. Set an environment variable in the \"victim\" process (standing in for a real CI secret such as `AWS_SECRET_ACCESS_KEY`): `GPY_SECRET_MARKER=AKIA_TOTALLY_FAKE_BUT_SECRET_LOOKING_VALUE_12345`. Then ran the exact ordinary workflow the `GHSA-hmq2-w58f-27jc` advisory's own PoC also uses:\n\n```python\nrepo = Repo.clone_from(evil_parent_url, victim_clone_dir)\nrepo.submodule_update(init=True, recursive=True)\n```\n\nObserved result (`ls .git/modules/`):\n\n```\n.git/modules/AKIA_TOTALLY_FAKE_BUT_SECRET_LOOKING_VALUE_12345/   (a full git repo: HEAD, config, objects/, refs/, hooks/)\n```\n\nThe literal `$GPY_SECRET_MARKER`-named directory was never created — only the expanded one exists, proving expansion happened before the value reached the `git clone --separate-git-dir=...` subprocess argument. The persistent, expanded-name directory under `.git/modules/` is itself the primary disclosure channel — it survives on disk for as long as the clone does. A second, independent channel: with the `git.cmd`/`git.repo.base` loggers at DEBUG level (a common CI/verbose-logging setting, not requiring any special flag), GitPython's own `Popen(...)` debug log line prints the fully expanded `--separate-git-dir=<value>` subprocess argument verbatim — `remove_password_if_present()` only redacts URL passwords/Authorization headers, not path-style arguments like this one, so the expanded value is not scrubbed. (The call also fails downstream with an `OSError`/`FileNotFoundError` referencing the original, unexpanded name, since `_write_git_file_and_module_config()` looks for a directory using the pre-expansion name — but that error message itself does not contain the expanded/secret value.)\n\n**Control**: the same call with an ordinary (no `$`) submodule name succeeds normally and creates `.git/modules/<name>` as expected — isolating the gap to submodule names containing environment-variable syntax specifically.\n\n### Already-known check\nChecked all 35 published `gitpython-developers/GitPython` security advisories in full text. `GHSA-hmq2-w58f-27jc` covers the same `name` → `.git/modules/<name>` path but for path-traversal (`../../..`), not variable expansion. `GHSA-59cr-6r3x-644w` covers the sibling `path` field reaching unguarded `os.makedirs()`. `GHSA-94p4-4cq8-9g67`/`GHSA-rwj8-pgh3-r573` cover `expand_vars`, but only on URL arguments. `git log -p -S \"separate_git_dir\" -- git/repo/base.py` shows neither fix commit touches this line; it is unchanged since its 2016 introduction (commit `57d05379`).\n\nThe closest topical match is `GHSA-8mcc-hrx5-hvxc` (\"`clone_from()`/`clone()` omit `--separate-git-dir` from `unsafe_git_clone_options`\") — already fixed, and its own text discusses this same `_clone()` handling of `separate_git_dir`. That fix only added `--separate-git-dir` to the `unsafe_git_clone_options` denylist, which gates the direct-kwarg vector; `Submodule._clone_repo()` explicitly sets `allow_unsafe_options=True` for the gitfile-submodules path, unconditionally bypassing that exact denylist (confirmed: the reproduction above succeeds against current `main`, which already has that fix). The bug this report describes is independent of that denylist — the *value* itself is expanded via `os.path.expandvars()` regardless of the denylist outcome — so the two are distinct, but flagging the relationship explicitly since a reviewer would otherwise reasonably ask about it.\n\nNo advisory describes environment-variable expansion via the internal `separate_git_dir` path.\n\n### Suggested fix\nAdd `expand_vars=False` to the `Git.polish_url(sep_dir)` call in `_clone()`, matching the four other call sites already fixed for the same class of issue.\n\n### Verification level\nReproduced in a real environment: plain Linux, unmodified GitPython from current `main`, real git ≥ 1.7.5 behavior, an ordinary `git submodule add` + `clone` + `submodule_update(init=True, recursive=True)` workflow with no non-default configuration or monkeypatching required. Causation isolated via a control group (identical workflow, ordinary submodule name, no expansion).\n\n### AI Use Disclosure\nAI (Claude) was used as a tool under my direction for code review, code summarization, and script development. A human reviewed and verified the AI-generated results before submission.\n\nCredit: please use \"baeseungwon1010\" (github.com/baeseungwon1010).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpython-developers/GitPython/pull/2255"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpython-developers/GitPython/commit/9349ff58ee00c9fb14d515c8e693f33b2144b238"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gitpython-developers/GitPython"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"
+    }
+  ]
+}