Bug 1223493

Summary:	VUL-0: CVE-2024-32884: cargo-c: gix-transport: indirect code execution via malicious username
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Carlos López <carlos.lopez>
Component:	Incidents	Assignee:	Antonio Larrosa <alarrosa>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	asn, carlos.lopez
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/403321/
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1223491

Description Carlos López 2024-04-29 09:37:23 UTC

cargo-c embeds gix-transport:

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32884
https://www.cve.org/CVERecord?id=CVE-2024-32884
https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh
https://rustsec.org/advisories/RUSTSEC-2024-0335.html