gix-worktree-state nonexclusive checkout sets executable files world-writable
Résumé
gix-worktree-state nonexclusive checkout sets executable files world-writable
Description d'origine
La description telle que publiée par la source (souvent en anglais).
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-22620 rust-gix-worktree-state Corrigé dans: 0.11.1-2
Références
- advisory rustsec.org
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- advisory github.com
- package crates.io
- web github.com