Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1ycmp3LWo0bTItbWYzNM4AA2CW

gix-transport code execution vulnerability

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.

PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.

Thanks for vin01 for disclosing this issue.

Permalink: https://github.com/advisories/GHSA-rrjw-j4m2-mf34
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycmp3LWo0bTItbWYzNM4AA2CW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 5 months ago


Identifiers: GHSA-rrjw-j4m2-mf34
References: Repository: https://github.com/Byron/gitoxide
Blast Radius: 0.0

Affected Packages

cargo:gix-transport
Dependent packages: 4
Dependent repositories: 153
Downloads: 4,250,734 total
Affected Version Ranges: < 0.36.1
Fixed in: 0.36.1
All affected versions: 0.25.4, 0.25.5, 0.25.6, 0.26.0, 0.27.0, 0.28.0, 0.29.0, 0.29.1, 0.30.0, 0.31.0, 0.32.0, 0.33.0, 0.33.1, 0.34.0, 0.34.1, 0.34.2, 0.35.0, 0.36.0
All unaffected versions: 0.36.1, 0.37.0, 0.37.1, 0.38.0, 0.39.0, 0.40.0, 0.40.1, 0.41.0, 0.41.1, 0.41.2, 0.41.3, 0.42.0, 0.42.1, 0.42.2, 0.42.3, 0.43.0, 0.43.1