CVE-2024-35186

HIGH8.8EPSS 0.36%

Traversal outside working tree enables arbitrary code execution

發布日:2024/5/22修改日:2026/4/28

描述

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

受影響套件(13)

crates.io/gitoxidefrom 0, < 0.36.0
crates.io/gitoxide-corefrom 0, < 0.38.0
crates.io/gixfrom 0, < 0.63.0
crates.io/gix-fsfrom 0, < 0.11.0
crates.io/gix-fs>= 0.0.0-0, < 0.11.0
crates.io/gix-index>= 0.0.0-0, < 0.33.0
crates.io/gix-indexfrom 0, < 0.33.0
crates.io/gix-worktree>= 0.0.0-0, < 0.34.0
crates.io/gix-worktreefrom 0, < 0.34.0
crates.io/gix-worktree-statefrom 0, < 0.11.0
Debian/rust-gix-fsfrom 0, < 0.11.3-1
Debian/rust-gix-indexfrom 0, < 0.33.1-1
Debian/rust-gix-worktreefrom 0, < 0.34.1-1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

描述

受影響套件(13)

CVSS 分數

參考連結(11)