Executive brief
gix-transport indirect code execution via malicious username
Affected products
- crates.io gix
- crates.io gix-transport
- crates.io gitoxide
Junglewise Threat Intelligence
CVE-2024-32884: RUSTSEC-2024-0335 - gix-transport indirect code execution via malicious username
CVE-2024-32884 · Severity: low · CVSS 3.1 · Published 2024-04-13
Technologies: gix (crates.io), gix-transport (crates.io), gitoxide (crates.io). Vendors: crates.io.
Related threats
- gitoxide path traversal in submodule name validation
- gitoxide symlink following in .gitmodules file
- gitoxide path traversal in submodule name resolution
- Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execu
- gitoxide gix-submodule command injection in gix_submodule::File::update