PT-2024-30655 · Gitoxide · Gitoxide

Eliahkagan · Published 2024-08-22 · Updated 2024-08-23 · CVE-2024-43785

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions gitoxide (affected versions not specified)

Description The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages. The effect is mostly an annoyance, but the author of a malicious repository who can predict how information from the repository may be accessed can cause files in the repository to be concealed or otherwise misrepresented, as well as rewrite all or part of error messages, or mimic error messages convincingly by repositioning the cursor and writing colored text. For users who do not clone or operate in clones of untrusted repositories, there is no impact. Windows is much less affected than Unix-like systems due to limitations on what characters can appear in filenames, and because traditionally Windows terminals do not support as many ANSI escape sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2024-43785

GHSA-88G2-R9RW-G55H

RUSTSEC-2024-0364

Affected Products

Gitoxide

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43785.json · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2024-0364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43785 · Security Note
• https://osv.dev/vulnerability/GHSA-88g2-r9rw-g55h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43785 · Vendor Advisory
• https://github.com/Byron/gitoxide/security/advisories/GHSA-88g2-r9rw-g55h · Note
• https://github.com/Byron/gitoxide/issues/1534 · Note
• https://github.com/Byron/gitoxide · Note
• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-88g2-r9rw-g55h · Note
• https://rustsec.org/advisories/RUSTSEC-2024-0364.html · Note
• https://crates.io/crates/gitoxide-core · Note
• https://twitter.com/VulmonFeeds/status/1826662319285264573 · Twitter Post
• https://t.me/cvedetector/3916 · Telegram Post
• https://twitter.com/CVEnew/status/1826633321834840465 · Twitter Post
• https://github.com/advisories/GHSA-88g2-r9rw-g55h · Note