gix traversal outside working tree enables arbitrary code execution
Résumé
gix traversal outside working tree enables arbitrary code execution
Description d'origine
La description telle que publiée par la source (souvent en anglais).
gitoxide is a pure Rust implementation of Git. During checkout, gix-worktree-state does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-35186 rust-gix-fs Corrigé dans: 0.11.3-1
Références
- advisory rustsec.org
- advisory github.com
- advisory nvd.nist.gov
- advisory rustsec.org
- advisory rustsec.org
- advisory github.com
- advisory github.com
- package crates.io
- package crates.io
- package crates.io
- web github.com