Use of Incorrectly-Resolved Name or Reference in gix-path - CVE-2024-45305

Vulnerability identifier: #VU129773

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45305

CWE-ID: CWE-706

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of incorrectly resolved name or reference in gix_path::env installation_config and installation_config_prefix when parsing the output of git config -l --show-origin to determine the installation configuration path. A remote attacker can cause local repository configuration to be treated as installation-wide configuration to disclose sensitive information.

User interaction is required, and exploitation occurs in uncommon situations where higher-scoped Git configuration is absent or deliberately disabled, such as when operating on one repository while located inside another repository.

gix-path
Fedora
rust-gix-trace
rust-gix-command
rust-gix-pathspec
rust-gix-dir
rust-gix-prompt
rust-gix-validate
rust-gix-date
rust-gix-sec
rust-gix-path
rust-gix-fs
rust-gix-ignore
rust-tame-index
rust-gix-worktree-state
rust-gix-status
rust-gix-filter
rust-gix-submodule
rust-gix-config-value
rust-cargo-deny
rust-gix-worktree-stream
rust-gix-negotiate
rust-gix-archive
rust-gix-revwalk
rust-gix-glob
rust-gix-packetline-blocking
rust-gix-packetline
rust-gix-attributes
rust-gix-mailmap
rust-gix-commitgraph
rust-gix-credentials
rust-gix-refspec
rust-gix-url
rust-gix-revision
rust-rustsec
rust-gix-actor
rust-gix-discover
rust-gix-index
rust-gix-worktree
rust-gix-features
rust-gix-config
rust-gix-traverse
rust-gix-transport
rust-gix-object
rust-gix-protocol
rust-gix-diff
rust-gix-ref
rust-gix-pack
rust-gix-odb
rust-gix
rust-cargo
stgit
rust-onefetch
rust-dua-cli
rust-vergen
rust-gix-tempfile
helix
rust-prodash

Install security update from vendor's website.

gix-path - update to 0.10.10
rust-gix-trace - update to 0.1.10-1.fc42
rust-gix-command - update to 0.3.9-1.fc42
rust-gix-pathspec - update to 0.7.7-1.fc42
rust-gix-dir - update to 0.8.0-1.fc42
rust-gix-prompt - update to 0.8.7-1.fc42
rust-gix-validate - update to 0.9.0-1.fc42
rust-gix-date - update to 0.9.0-1.fc42
rust-gix-sec - update to 0.10.8-1.fc42
rust-gix-path - update to 0.10.11-1.fc42
rust-gix-fs - update to 0.11.3-1.fc42
rust-gix-ignore - update to 0.11.4-1.fc42
rust-tame-index - update to 0.12.0-3.fc42
rust-gix-worktree-state - update to 0.13.0-1.fc42
rust-gix-status - update to 0.13.0-1.fc42
rust-gix-filter - update to 0.13.0-1.fc42
rust-gix-submodule - update to 0.14.0-1.fc42
rust-gix-config-value - update to 0.14.8-1.fc42
rust-cargo-deny - update to 0.14.24-3.fc42
rust-gix-worktree-stream - update to 0.15.0-1.fc42
rust-gix-negotiate - update to 0.15.0-1.fc42
rust-gix-archive - update to 0.15.0-1.fc42
rust-gix-revwalk - update to 0.15.0-1.fc42
rust-gix-glob - update to 0.16.5-1.fc42
rust-gix-packetline-blocking - update to 0.17.5-1.fc42
rust-gix-packetline - update to 0.17.6-1.fc42
rust-gix-attributes - update to 0.22.5-1.fc42
rust-gix-mailmap - update to 0.24.0-1.fc42
rust-gix-commitgraph - update to 0.24.3-1.fc42
rust-gix-credentials - update to 0.24.5-1.fc42
rust-gix-refspec - update to 0.25.0-1.fc42
rust-gix-url - update to 0.27.5-1.fc42
rust-gix-revision - update to 0.29.0-1.fc42
rust-rustsec - update to 0.29.3-3.fc42
rust-gix-actor - update to 0.32.0-1.fc42
rust-gix-discover - update to 0.35.0-1.fc42
rust-gix-index - update to 0.35.0-1.fc42
rust-gix-worktree - update to 0.36.0-1.fc42
rust-gix-features - update to 0.38.2-3.fc42
rust-gix-config - update to 0.40.0-1.fc42
rust-gix-traverse - update to 0.41.0-1.fc42
rust-gix-transport - update to 0.42.3-1.fc42
rust-gix-object - update to 0.44.0-1.fc42
rust-gix-protocol - update to 0.45.3-1.fc42
rust-gix-diff - update to 0.46.0-1.fc42
rust-gix-ref - update to 0.47.0-1.fc42
rust-gix-pack - update to 0.53.0-1.fc42
rust-gix-odb - update to 0.63.0-1.fc42
rust-gix - update to 0.66.0-1.fc42
rust-cargo - update to 0.79.0-4.fc42
stgit - update to 2.4.12-1.fc42
rust-onefetch - update to 2.21.0-4.fc42
rust-dua-cli - update to 2.29.2-1.fc42
rust-vergen - update to 8.3.1-4.fc42
rust-gix-tempfile - update to 14.0.2-1.fc42
helix - update to 24.07-2.fc42
rust-prodash - update to 29.0.0-1.fc42

• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6
• https://github.com/GitoxideLabs/gitoxide/commit/12251eb052df30105538fa831e641eea557f13d8

• Use of Incorrectly-Resolved Name or Reference in gix-path
• Fedora 42 update for helix, rust-cargo, rust-cargo-deny, rust-dua-cli, rust-gix, rust-gix-actor, rust-gix-archive, rust-gix-attributes, rust-gix-command, rust-gix-commitgraph, rust-gix-config, rust-gix-config-value, rust-gix-credentials, rust-gix-date, ru