Описание
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| rust-gix-index | fixed | 0.33.1-1 | package | |
| rust-gitoxide | itp | package | ||
| rust-gix-worktree | fixed | 0.34.1-1 | package | |
| rust-gix-fs | fixed | 0.11.3-1 | package |
Примечания
https://rustsec.org/advisories/RUSTSEC-2024-0348.html
https://rustsec.org/advisories/RUSTSEC-2024-0349.html
https://rustsec.org/advisories/RUSTSEC-2024-0350.html
https://github.com/advisories/GHSA-7w47-3wg8-547c
EPSS
Связанные уязвимости
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
gix traversal outside working tree enables arbitrary code execution
Уязвимость библиотеки на языке Rust для работы с Git-репозиториями gitoxide, связанная с ошибками в обработке относительного пути к каталогу, позволяющая нарушителю выполнить произвольный код
EPSS