Description

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

INFO

Published Date :

2024-04-26T18:04:04.374Z

Last Modified :

2024-08-02T02:20:35.704Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-32884 vulnerability.

Vendors Products
Byron
  • Gitoxide
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-32884.

URL Resource
https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh cve-icon cve-icon
https://rustsec.org/advisories/RUSTSEC-2024-0335.html cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact