GHSA-p3hx-pwf3-j8wr Nautobot: GitRepository.current_head field should not be writable through REST API

• PyPI nautobot: >= 3.0.0a2, < 3.1.2 → fixed in 3.1.2 • PyPI nautobot: < 2.4.33 → fixed in 2.4.33

Impact A user with access to add/change a GitRepository record could use the REST API to directly set the `current_head` field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified `branch` (resulting in misleading state), or potentially to be unable to make use of the repository at all (until manually remediated) due to the `current_head` pointing to a nonexistent commit hash or malformed value. Patches The issue has been remediated in Nautobot v2.4.33 and 3.1.2. Workarounds Note that many of the same end-result symptoms could be caused by a user with the same level of access simply changing the `branch` or `remote_url` of a GitRepository rather than crafting the `current_head`. Administrators are encouraged to carefully review which users are granted permissions to create and modify GitRepository records. References • 2.4.33 (patch) • 3.1.2 (patch)