Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
No package-associated file paths were observed for the displayed build metadata.
OpenFactory puede arrancar este sistema operativo en una máquina virtual del navegador, o iniciar una construcción que incluye el nombre nativo del paquete de este registro.
Cada fila es metadato del índice de paquetes para una versión, arquitectura, suite y repositorio. Nombres, URL y tamaños vienen de la fuente; un enlace es un punto de descarga que puede cambiar, no una redistribución de OpenFactory.
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components
Medium(6.9)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers cont
Critical(9.2)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can
High(7.7)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can s
High(8.7)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_var
High(7.1)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() t
High(8.7)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object w
High(8.7)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with
High(7.1)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can e
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing the
High(7.1)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attacker
High(8.6)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a sepa
High(8.7)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference
High(7.1)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Att
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --outp
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to over
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. At
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbo
High(8.8)
Desconocido
La asociación de paquetes está en curso. Observado:
