CVE-2026-42305
Description
A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious Git repository. This could lead to an arbitrary file write, ultimately resulting in remote code execution on the affected system.
Statement
This is an Important flaw in Dulwich, a Python Git library, primarily impacting Windows systems. While Red Hat Enterprise Linux and other POSIX-based Red Hat products are not directly vulnerable to remote code execution, they can serve as vectors for propagating malicious Git repositories to Windows clients. Exploitation occurs when a user clones or checks out a specially crafted repository on a Windows system, leading to arbitrary file write and potential remote code execution.
Red Hat Satellite ships the python-dulwich package however, this flaw primarily affects Dulwich when cloning or checking out a malicious Git repository on Windows, where NTFS path handling can lead to arbitrary file write and remote code execution. Red Hat Satellite runs on Red Hat Enterprise Linux and other POSIX platforms, where this Windows-specific path behavior does not apply. Therefore, Red Hat Satellite is not directly affected by this vulnerability.
Mitigation
Mitigation for this issue involves avoiding the cloning, fetching, or checking out of untrusted Git repositories with Dulwich. This operational control is crucial for preventing the introduction and propagation of malicious content, especially when Red Hat systems interact with or serve Windows clients that utilize Dulwich.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
