VDB
CVE-2024-45305
CVE-2024-45305
PUBLISHED
CVSS 2.5 LOW
gix-path uses local config across repos when it is the highest scope
EPSS 0.24% · 15.4th percentile
Risk Scores
CVSS 3.1
2.5
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score
0.24%
15.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Byron | gitoxide | *, < 0.10.10 |
| crates.io | gix-path | 0, 0 |
| byron | gitoxide | 0, 0 |
Timeline
- Jan 21, 1970 Security Advisory
- Aug 31, 2024 CVE Published
- Aug 31, 2024 PoC Published
- Sep 2, 2024 PoC Published
- Sep 3, 2024 EPSS Score
- Sep 23, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 13, 2024 EPSS Score
- Nov 3, 2024 EPSS Score
- Nov 23, 2024 EPSS Score
- Dec 14, 2024 EPSS Score
- Jan 3, 2025 EPSS Score
References
- https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-45305 advisory
- https://git-scm.com/docs/git-config#SCOPES url
- https://github.com/Byron/gitoxide package
- https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L112 url
- https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L91 url
- https://rustsec.org/advisories/RUSTSEC-2024-0367.html url