gitoxide (>=0.1.0, <=0.15.0) potentially affected by CVE-2024-43785 via gitoxide-core (>=0.1.0, <=0.17.0)

gitoxide-core CARGO version =0.1.0, =0.1.0, =0.15.0 Source cves: CVE-2024-43785 Source advisory: OSV:GHSA-88G2-R9RW-G55H...

gitoxide (>=0.1.0, <=0.15.0) potentially affected by CVE-2024-43785 via gitoxide-core (>=0.1.0, <=0.17.0)

gitoxide-core CARGO version =0.1.0, =0.1.0, =0.15.0 Source cves: CVE-2024-43785 Source advisory: GHSA-88G2-R9RW-G55H...

CVE-2024-43785

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

CVE-2024-43785 gitoxide-core does not neutralize special characters for terminals

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

CVE-2024-43785

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

CVE-2024-43785

CVE-2024-43785 involves gitoxide-core (and its gix/ein commands) not neutralizing special characters in terminal output. The root cause is that newlines, backspaces, and control characters—including ANSI escape sequences—are not sanitized in repository metadata (paths, author/committer names, com...

CVE-2024-43785 gitoxide-core does not neutralize special characters for terminals

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

CVE-2024-43785 gitoxide-core does not neutralize special characters for terminals

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

RUSTSEC-2024-0364 gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

gitoxide (>=0.1.0, <=0.15.0) potentially affected by CVE-2024-43785 via gitoxide-core (>=0.1.0, <=0.17.0)

gitoxide-core CARGO version =0.1.0, =0.1.0, =0.15.0 Source cves: CVE-2024-43785 Source advisory: OSV:RUSTSEC-2024-0364...

CVE-2024-43785: Improper Neutralization of Escape, Meta, or Control Sequences

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a...

GitOxide security vulnerabilities

gitoxide is a git implementation written in Rust by the individual developer Sebastian Thiel. A security vulnerability exists in gitoxide that originated from not eliminating line breaks, backspaces, or control characters that appear in repository paths, author and committer names, commit message...

PT-2024-30655 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide affected versions not specified Description: The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometim...

CBL Mariner 2.0 Security Update: rust (CVE-2024-32884)

The version of rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32884 advisory. - gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for tex...

Rust Git Library Code Execution

The vulnerability of the Rust library for working with Git repositories like gitoxide is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted URL address...

CVE-2024-40644

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...

CVE-2024-40644 gitoxide's gix-path can use a fake program files location

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...

CVE-2024-40644 gitoxide's gix-path can use a fake program files location

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...

CVE-2024-40644

The CVE-2024-40644 issue affects gitoxide’s gix-path on Windows. Affected code path allows a limited user to place a malicious git.exe in hard-coded fallback locations (C:/Program Files/Git/mingw64/bin or C:/Program Files (x86)/Git/mingw32/bin). gix-path’s env logic may directly execute that git....