CVE-2024-35197
published 2024-05-23CVE-2024-35197: gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths…
PriorityP427medium5.4CVSS 3.1
AVNACLPRNUIRSUCNILAL
EPSS
0.45%
35.8th percentile
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| byron | gitoxide | < 0.36.0 | 0.36.0 |
| byron | gitoxide | >= 0 < 0.36.0 | 0.36.0 |
| byron | gitoxide | 0 – 0.41.0 | — |
| debian | rust-gix-index | — | — |
| debian | rust-gix-ref | — | — |
| debian | rust-gix-worktree | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
vendor_debian5.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
gitoxide-core does not neutralize special characters for terminals
osv·2024-08-22
CVE-2024-43785 gitoxide-core does not neutralize special characters for terminals
gitoxide-core does not neutralize special characters for terminals
### Summary
The `gix` and `ein` commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.
### Details
`gitoxide-core`, which provides most underlying functionality of the `gix` and `ein` commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages wh
OSV
gitoxide-core does not neutralize special characters for terminals
osv·2024-08-22
CVE-2024-43785 [LOW] gitoxide-core does not neutralize special characters for terminals
gitoxide-core does not neutralize special characters for terminals
### Summary
The `gix` and `ein` commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.
### Details
`gitoxide-core`, which provides most underlying functionality of the `gix` and `ein` commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages wh
GHSA
gitoxide-core does not neutralize special characters for terminals
ghsa·2024-08-22
CVE-2024-43785 [LOW] CWE-150 gitoxide-core does not neutralize special characters for terminals
gitoxide-core does not neutralize special characters for terminals
### Summary
The `gix` and `ein` commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.
### Details
`gitoxide-core`, which provides most underlying functionality of the `gix` and `ein` commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages wh
OSV
gix refs and paths with reserved Windows device names access the devices
osv·2024-05-22
CVE-2024-35197 [MEDIUM] gix refs and paths with reserved Windows device names access the devices
gix refs and paths with reserved Windows device names access the devices
### Summary
On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances.
### Details
It is possible to create a Git repository that contains references or filenames that Windows treats as legacy DOS-style aliases for system devices. When such a repository is cloned:
- In references, `gix-ref` does not include a check for such names before attempting to access them on disk, which reads
OSV
Refs and paths with reserved Windows device names access the devices
osv·2024-05-22
CVE-2024-35197 Refs and paths with reserved Windows device names access the devices
Refs and paths with reserved Windows device names access the devices
### Summary
On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances.
### Details
It is possible to create a Git repository that contains references or filenames that Windows treats as legacy DOS-style aliases for system devices. When such a repository is cloned:
- In references, `gix-ref` does not include a check for such names before attempting to access them on disk, which reads from
GHSA
gix refs and paths with reserved Windows device names access the devices
ghsa·2024-05-22
CVE-2024-35197 [MEDIUM] CWE-67 gix refs and paths with reserved Windows device names access the devices
gix refs and paths with reserved Windows device names access the devices
### Summary
On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances.
### Details
It is possible to create a Git repository that contains references or filenames that Windows treats as legacy DOS-style aliases for system devices. When such a repository is cloned:
- In references, `gix-ref` does not include a check for such names before attempting to access them on disk, which reads
Debian
CVE-2024-35197: rust-gix-index - gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that cl...
vendor_debian·2024·CVSS 5.4
CVE-2024-35197 [MEDIUM] CVE-2024-35197: rust-gix-index - gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that cl...
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.
Scope: local
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-23
Published