dulwich commit parser misreads duplicate tree headers, allowing code execution
Git-based install tools can run hidden malicious build scripts.
Summary
dulwich is a library for working with Git repositories. It resolves duplicate tree headers in commit objects differently from Git, so unreviewed malicious build scripts can run on install or build hosts.
Affected when
- Tools such as Poetry 2.5.1 that use dulwich to install git dependencies
What to do
Update to dulwich 1.2.20 or later.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen