CVE-2024-35186 — Relative Path Traversal in Gitoxide

CWE-23 — Relative Path TraversalCWE-22 — Path Traversal6 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 37.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Byron GitoxideDebian Rust-gix-fsDebian Rust-gix-index+1 more
Timeline
PublishedMay 23

Description

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/rust-gix-worktree< rust-gix-fs 0.11.3-1 (forky)
▶CVEListV5byron/gitoxide< 0.36.0
▶crates.iobyron/gitoxide< 0.36.0
▶debiandebian/rust-gix-fs< rust-gix-fs 0.11.3-1 (forky)
▶debiandebian/rust-gix-index< rust-gix-fs 0.11.3-1 (forky)

🔴Vulnerability Details

4
OSV
CVE-2024-35186: gitoxide is a pure Rust implementation of Git↗2024-05-23
▶
GHSA
gix traversal outside working tree enables arbitrary code execution↗2024-05-22
▶
OSV
Traversal outside working tree enables arbitrary code execution↗2024-05-22
▶
OSV
gix traversal outside working tree enables arbitrary code execution↗2024-05-22
▶

📋Vendor Advisories

1
Debian
CVE-2024-35186: rust-gix-fs - gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-st...↗2024
▶