Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, sensible Inhalte lokaler Dateien offenzulegen und einen Denial-of-Service-Zustand auszulösen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Criticalbsi:WID-SEC-2026-45324 linked CVEs
Open advisory with all CVEs
More on GitPython
Other advisories
- CriticalCVE-2026-110856Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen
- Not ratedosv:MGASA-2026-0580Updated python-gitpython package fixes security vulnerabilities
- Not ratedosv:CLSA-2026-1793612016TuxCare security update for gitpython (1 CVE)
- Not ratedosv:openSUSE-SU-2026:12391-1python313-GitPython-3.2.1-1.1 on GA media
- HighCVE-2026-110859GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
- Highghsa:GHSA-23mf-xhv8-69c2GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
- MediumCVE-2026-110860GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
- Mediumghsa:GHSA-gq48-pqfc-9p58GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4532
ID