checkout-index

checkout-index - CVE-2025-22620 的复现工具 这是针对 RUSTSEC-2025-0001 CVE-2025-22620, GHSA-fqmf-w4xh-33rh 的概念验证代码。它与公告中的代码相同，但以 Rust 项目的形式提供，并包含了 Cargo.toml 和 Cargo.lock。 这个仓库在撰写公告时很有用，我想偶尔也可能对其他人有用。不过，我预计它的价值远不及公告本身，同时它也不能替代公告中的信息。如公告所述，该漏洞已在 gix-worktree-state 0.17.0 中修复。 分支 main 分支包含公告中步骤 2 所展示的代码版本。...

DEBIAN-CVE-2025-22620

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620 vulnerabilities

Vulnerabilities for packages: cargo-audit...

CVE-2025-22620 vulnerabilities

Vulnerabilities for packages: cargo-audit...

CVE-2025-22620

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620 gix-worktree-state nonexclusive checkout sets executable files world-writable

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620 gix-worktree-state nonexclusive checkout sets executable files world-writable

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620

Summary: CVE-2025-22620 affects gitoxide’s gix-worktree-state, where one checkout strategy can apply 0777 permissions to executable files in Unix-like systems, bypassing the umask and potentially making files world-writable. This occurs in the checkout logic depending on destination_is_initially_...

CVE-2025-22620 gix-worktree-state nonexclusive checkout sets executable files world-writable

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...