PT-2025-4606 · Gitoxide · Gitoxide

Eliahkagan · Published 2025-01-18 · Updated 2025-04-15 · CVE-2025-22620

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.17.0

Description The issue arises from the gix-worktree-state specifying 0777 permissions when checking out executable files. This is intended to be restricted by the umask, but one of the strategies used to set permissions is not subject to the umask, causing files in a repository to be world-writable in some situations. This problem affects Unix-like systems but not Windows and can lead to security issues on multi-user systems or when accounts are used to run software with reduced abilities.

Recommendations For versions prior to 0.17.0, update to version 0.17.0 or later to resolve the issue. As a temporary workaround, consider setting destination is initially empty to true when using gix::worktree::state::checkout to avoid the vulnerable strategy. However, the most effective solution is to update to a version where this vulnerability is fixed.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

CWE-687

Related Identifiers

CVE-2025-22620

GHSA-FQMF-W4XH-33RH

OPENSUSE-SU-2025:14994-1

RUSTSEC-2025-0001

Affected Products

Gitoxide

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22620.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-22620 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14994-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-22620 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-22620 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-22620 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22620 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fqmf-w4xh-33rh · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-22620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22620 · Security Note
• https://github.com/GitoxideLabs/gitoxide · Note
• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fqmf-w4xh-33rh · Note
• https://twitter.com/CVEnew/status/1881368618463547528 · Twitter Post
• https://suse.com/security/cve/CVE-2025-22620 · Note