Improper Resolution of Path Equivalence in gix-path - CVE-2024-45405

Vulnerability identifier: #VU129772

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45405

CWE-ID: CWE-41

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper resolution of path equivalence in gix_path::env installation_config and installation_config_prefix when parsing the path reported by git config -l --show-origin. A local user can create a crafted configuration path that is resolved to an attacker-controlled file to execute arbitrary code.

User interaction is required, and exploitation is only plausible in uncommon multi-user or unusually configured environments.

gix-path
openSUSE Leap
Fedora
rust-gix-trace
rust-gix-command
rust-gix-pathspec
rust-gix-dir
rust-gix-prompt
rust-gix-date
rust-gix-validate
cargo-c
cargo-c-debuginfo
rust-gix-sec
rust-gix-path
rust-gix-fs
rust-gix-ignore
rust-tame-index
rust-gix-status
rust-gix-worktree-state
rust-gix-filter
rust-gix-submodule
rust-gix-config-value
rust-cargo-deny
rust-gix-revwalk
rust-gix-negotiate
rust-gix-worktree-stream
rust-gix-archive
rust-gix-glob
rust-gix-packetline-blocking
rust-gix-packetline
rust-gix-attributes
rust-gix-mailmap
rust-gix-commitgraph
rust-gix-credentials
rust-gix-refspec
rust-gix-url
rust-gix-revision
rust-rustsec
rust-gix-actor
rust-gix-index
rust-gix-discover
rust-gix-worktree
rust-gix-features
rust-gix-config
rust-gix-traverse
rust-gix-transport
rust-gix-object
rust-gix-protocol
rust-gix-diff
rust-gix-ref
rust-gix-pack
rust-gix-odb
rust-gix
rust-cargo
stgit
rust-onefetch
rust-dua-cli
rust-vergen
rust-gix-tempfile
helix
rust-prodash

Install security update from vendor's website.

gix-path - update to 0.10.11
rust-gix-trace - update to 0.1.10-1.fc42
rust-gix-command - update to 0.3.9-1.fc42
rust-gix-pathspec - update to 0.7.7-1.fc42
rust-gix-dir - update to 0.8.0-1.fc42
rust-gix-prompt - update to 0.8.7-1.fc42
rust-gix-date - update to 0.9.0-1.fc42
rust-gix-validate - update to 0.9.0-1.fc42
cargo-c - update to 0.10.3~git0.ee7d7ef-150600.3.3.1
cargo-c-debuginfo - update to 0.10.3~git0.ee7d7ef-150600.3.3.1
rust-gix-sec - update to 0.10.8-1.fc42
rust-gix-path - update to 0.10.11-1.fc42
rust-gix-fs - update to 0.11.3-1.fc42
rust-gix-ignore - update to 0.11.4-1.fc42
rust-tame-index - update to 0.12.0-3.fc42
rust-gix-status - update to 0.13.0-1.fc42
rust-gix-worktree-state - update to 0.13.0-1.fc42
rust-gix-filter - update to 0.13.0-1.fc42
rust-gix-submodule - update to 0.14.0-1.fc42
rust-gix-config-value - update to 0.14.8-1.fc42
rust-cargo-deny - update to 0.14.24-3.fc42
rust-gix-revwalk - update to 0.15.0-1.fc42
rust-gix-negotiate - update to 0.15.0-1.fc42
rust-gix-worktree-stream - update to 0.15.0-1.fc42
rust-gix-archive - update to 0.15.0-1.fc42
rust-gix-glob - update to 0.16.5-1.fc42
rust-gix-packetline-blocking - update to 0.17.5-1.fc42
rust-gix-packetline - update to 0.17.6-1.fc42
rust-gix-attributes - update to 0.22.5-1.fc42
rust-gix-mailmap - update to 0.24.0-1.fc42
rust-gix-commitgraph - update to 0.24.3-1.fc42
rust-gix-credentials - update to 0.24.5-1.fc42
rust-gix-refspec - update to 0.25.0-1.fc42
rust-gix-url - update to 0.27.5-1.fc42
rust-gix-revision - update to 0.29.0-1.fc42
rust-rustsec - update to 0.29.3-3.fc42
rust-gix-actor - update to 0.32.0-1.fc42
rust-gix-index - update to 0.35.0-1.fc42
rust-gix-discover - update to 0.35.0-1.fc42
rust-gix-worktree - update to 0.36.0-1.fc42
rust-gix-features - update to 0.38.2-3.fc42
rust-gix-config - update to 0.40.0-1.fc42
rust-gix-traverse - update to 0.41.0-1.fc42
rust-gix-transport - update to 0.42.3-1.fc42
rust-gix-object - update to 0.44.0-1.fc42
rust-gix-protocol - update to 0.45.3-1.fc42
rust-gix-diff - update to 0.46.0-1.fc42
rust-gix-ref - update to 0.47.0-1.fc42
rust-gix-pack - update to 0.53.0-1.fc42
rust-gix-odb - update to 0.63.0-1.fc42
rust-gix - update to 0.66.0-1.fc42
rust-cargo - update to 0.79.0-4.fc42
stgit - update to 2.4.12-1.fc42
rust-onefetch - update to 2.21.0-4.fc42
rust-dua-cli - update to 2.29.2-1.fc42
rust-vergen - update to 8.3.1-4.fc42
rust-gix-tempfile - update to 14.0.2-1.fc42
helix - update to 24.07-2.fc42
rust-prodash - update to 29.0.0-1.fc42

• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-m8rp-vv92-46c7
• https://github.com/GitoxideLabs/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031

• Improper Resolution of Path Equivalence in gix-path
• Fedora 42 update for helix, rust-cargo, rust-cargo-deny, rust-dua-cli, rust-gix, rust-gix-actor, rust-gix-archive, rust-gix-attributes, rust-gix-command, rust-gix-commitgraph, rust-gix-config, rust-gix-config-value, rust-gix-credentials, rust-gix-date, ru
• SUSE update for cargo-c