Gitoxide Git Vulnerability Affects Confidentiality, Integrity, and Availability

CVE-2024-35186

What is CVE-2024-35186?

Gitoxide, a Rust implementation of Git, presents a vulnerability related to path traversal during checkout operations. The component 'gix-worktree-state' does not adequately validate paths, allowing specially crafted repositories to direct files to any writable locations on the system. This flaw poses a significant threat to the confidentiality, integrity, and availability of user data. Although execution of malicious code isn't directly facilitated, the ability to create files outside designated working trees undermines data integrity across the application. Users are recommended to update to version 0.36.0 or later, where this vulnerability is addressed.

References