Byron gitoxide up to 0.10.9 Configuration File gix_path::env name resolution

Summaryinfo

A vulnerability has been found in Byron gitoxide up to 0.10.9 and classified as problematic. The impacted element is the function gix_path::env of the component Configuration File Handler. This manipulation causes name resolution. The identification of this vulnerability is CVE-2024-45305. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Byron gitoxide up to 0.10.9 and classified as problematic. Affected by this vulnerability is the function gix_path::env of the component Configuration File Handler. The manipulation with an unknown input leads to a name resolution vulnerability. The CWE definition for the vulnerability is CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. As an impact it is known to affect confidentiality. The summary by CVE is:

gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-45305 since 08/26/2024. The exploitation appears to be difficult. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 0.10.10 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Byron

Name

• gitoxide

Version

• 0.10.0
• 0.10.1
• 0.10.2
• 0.10.3
• 0.10.4
• 0.10.5
• 0.10.6
• 0.10.7
• 0.10.8
• 0.10.9

Website

• Product: https://github.com/Byron/gitoxide/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion