SB2024091972 - Fedora 42 update for helix, rust-cargo, rust-cargo-deny, rust-dua-cli, rust-gix, rust-gix-actor, rust-gix-archive, rust-gix-attributes, rust-gix-command, rust-gix-commitgraph, rust-gix-config, rust-gix-config-value, rust-gix-credentials, rust-gix-date, ru
Published: September 19, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2024-45305)
CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of incorrectly resolved name or reference in gix_path::env installation_config and installation_config_prefix when parsing the output of git config -l --show-origin to determine the installation configuration path. A remote attacker can cause local repository configuration to be treated as installation-wide configuration to disclose sensitive information.
User interaction is required, and exploitation occurs in uncommon situations where higher-scoped Git configuration is absent or deliberately disabled, such as when operating on one repository while located inside another repository.
2) Improper Resolution of Path Equivalence (CVE-ID: CVE-2024-45405)
CWE-ID: CWE-41 - Improper Resolution of Path Equivalence
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper resolution of path equivalence in gix_path::env installation_config and installation_config_prefix when parsing the path reported by git config -l --show-origin. A local user can create a crafted configuration path that is resolved to an attacker-controlled file to execute arbitrary code.
User interaction is required, and exploitation is only plausible in uncommon multi-user or unusually configured environments.
Remediation
Install update from vendor's website.