PT-2024-35081 · Jj · Jj
Joernchen
·
Published
2024-11-06
·
Updated
2024-11-12
·
CVE-2024-51990
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
jj versions prior to 0.23.0
Description
Specially crafted Git repositories can cause
jj to write files outside the clone. This issue can be achieved by having file objects which contain path traversals. To exploit this, an attacker would need to create a crafted Git repository and have the victim clone it using jj. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.Recommendations
For versions prior to 0.23.0, upgrade to version 0.23.0 to address the issue.
As a temporary workaround, consider avoiding cloning repositories from untrusted sources until a patch is available.
Restrict access to unknown Git repositories to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jj