PT-2024-36707 · Gitingest · Gitingest

Nollium · Published 2024-12-15 · Updated 2024-12-16 · CVE-2024-56074

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions gitingest versions before 9996a06

Description The issue is related to the mishandling of symbolic links that point outside of the base directory. This can lead to a symbolic link traversal vulnerability.

Recommendations For gitingest versions before 9996a06, consider restricting the use of symbolic links that point outside the base directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2024-56074

Affected Products

Gitingest

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-56074 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56074 · Vendor Advisory
• https://github.com/cyclotruc/gitingest/blob/9996a06a94450497c1abb35997f5e6cbc9b571ff/src/ingest.py#L99-L100 · Note
• https://github.com/cyclotruc/gitingest/blob/9996a06a94450497c1abb35997f5e6cbc9b571ff/src/ingest.py#L22-L30 · Note
• https://github.com/cyclotruc/gitingest/pull/23 · Note
• https://github.com/cyclotruc/gitingest/commit/9996a06a94450497c1abb35997f5e6cbc9b571ff · Note
• https://twitter.com/CVEnew/status/1868271096555770248 · Twitter Post
• https://gitingest.com · Note
• https://twitter.com/VulmonFeeds/status/1868154054855041317 · Twitter Post
• https://t.me/cvedetector/12950 · Telegram Post
• https://t.me/cvenotify/104393 · Telegram Post
• https://t.me/cvenotify/104329 · Telegram Post