security: cve-2024-22910

[misogihagi]

GHSA-2mqj-m65w-jghx

[lukehinds]

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

[sigmavirus24]

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

It really doesn't feel worth it. Greater equal means reinstalling will get you the new version unless you otherwise have it constrained. And if you have it constrained you have the power to shut up those scanners that suck so very much

[lukehinds]

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

It really doesn't feel worth it. Greater equal means reinstalling will get you the new version unless you otherwise have it constrained. And if you have it constrained you have the power to shut up those scanners that suck so very much

I am inclined to agree. Let's roll it up in the next release.

I will close, but thanks for raising @misogihagi

[lukehinds]

Reopen (it was a PR, not an issue)

[ericwb]

We also don't support or test running Bandit on Windows, so this CVE doesn't apply.

[sigmavirus24]

Fixing this by making gitpython an extra