Executive brief
Dulwich, a Python implementation of the Git file format and protocols, is vulnerable to a flaw that allows remote attackers to execute arbitrary code. By sending a specially crafted commit containing directory paths starting with '.git/', an attacker can bypass security checks during the checkout process. This could lead to a full system compromise or unauthorized access to sensitive repository data.
Technical details
A vulnerability exists in the 'build_index_from_tree' function within 'index.py' of Dulwich (versions <= 0.9.9). The root cause is improper validation of directory paths during the process of checking out a working tree. Specifically, the library fails to block or safely handle paths starting with '.git/', which allows an attacker to overwrite internal Git metadata or configuration files. A remote attacker can exploit this by providing a malicious commit to a system using Dulwich for Git operations, leading to arbitrary code execution. This issue was addressed in version 0.9.10 by improving path handling logic.
Affected products
- Jelmer Vernooij dulwich < 0.9.10
Timeline
- 2014-12-18: patched: Fix committed to upstream repository
- 2015-03-31: disclosed: NVD publication date
- 2022-05-17: advisory: GitHub Advisory published