Log in Start free

Vulnerability · Published May 23, 2024 · Assigned by GitHub_M

CVE-2024-35186gix traversal outside working tree enables arbitrary code execution

High 8.8

In plain English

A high-severity security flaw in gitoxide from Byron. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 42.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-gix-fs0.11.3-1DEBIAN-CVE-2024-35186
Debian:14rust-gix-fs0.11.3-1DEBIAN-CVE-2024-35186
Debian:13rust-gix-index0.33.1-1DEBIAN-CVE-2024-35186
Debian:14rust-gix-index0.33.1-1DEBIAN-CVE-2024-35186
Debian:13rust-gix-worktree0.34.1-1DEBIAN-CVE-2024-35186
Debian:14rust-gix-worktree0.34.1-1DEBIAN-CVE-2024-35186
Ubuntu:24.04:LTSrust-gix-fsno fix listedUBUNTU-CVE-2024-35186

Affected products (as reported)

VendorProductVersions
Byron gitoxide < 0.36.0

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References