{"id":"EUVD-2024-1168","enisaUuid":"932597a1-3996-3229-962d-0d18e49ac974","description":"gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.","datePublished":"Apr 26, 2024, 6:04:04 PM","dateUpdated":"Aug 2, 2024, 2:20:35 AM","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh\nhttps://rustsec.org/advisories/RUSTSEC-2024-0335.html\n","aliases":"CVE-2024-32884\nGHSA-98p4-xjmm-8mfh\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"08ecc798-a24b-3dbb-821a-2e1915dd0941","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.62"},{"id":"29cc6ff2-6d29-37ed-9024-19be90b9faa4","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.35"},{"id":"c7683d8b-23a7-3f2b-a5a0-8c581aca41f0","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.42.0"},{"id":"c8434bb2-205b-3361-bf64-e29ee1f738b2","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}}}],"enisaIdVendor":[{"id":"835c1b7b-eef0-355a-ab09-e4c16a84f265","vendor":{"name":"Byron"}}],"enisaIdVulnerability":[{"id":"974604d5-4c94-3c88-9301-e3e7cb339985","vulnerability":{"id":"CVE-2024-32884","description":"gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.","datePublished":"Apr 26, 2024, 6:04:04 PM","dateUpdated":"Aug 2, 2024, 2:20:35 AM","status":"PUBLISHED","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh\nhttps://rustsec.org/advisories/RUSTSEC-2024-0335.html\n","enisa_id":"EUVD-2024-1168\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 2, 2026, 7:15:48 AM","vulnerabilityProduct":[{"id":"1912fb10-030a-3614-8cb7-d959da1f5412","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.62"},{"id":"45471838-06d9-45ae-ba80-1db0b5ef35fc","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.35"},{"id":"6232e42f-d697-48f8-ac99-748c7e9556ff","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.62"},{"id":"886c6547-165e-36b2-ac07-7b7edef718c7","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.35"},{"id":"9546d409-e6d3-4cc5-a2ec-7cb2e771d86b","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.42.0"},{"id":"b1b753ea-2fc7-30e6-9430-803a5fe47252","product":{"name":"gitoxide","vendor":{"name":"GitoxideLabs"}},"product_version":"\u003c 0.42.0"}],"vulnerabilityVendor":[{"id":"c54c4233-c9ef-3f6c-972c-f202d963e874","vendor":{"name":"Byron"}}]}},{"id":"a1bdec96-e792-3cf7-a84b-bc1269cb3e50","vulnerability":{"id":"GHSA-98p4-xjmm-8mfh","description":"gix-transport indirect code execution via malicious username","datePublished":"Apr 15, 2024, 7:33:03 PM","dateUpdated":"Jul 5, 2024, 6:07:37 PM","baseScore":null,"references":"https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-32884\nhttps://github.com/Byron/gitoxide\nhttps://rustsec.org/advisories/RUSTSEC-2024-0335.html\n","enisa_id":"EUVD-2024-1168\n","aliases":"GHSA-98p4-xjmm-8mfh\nCVE-2024-32884\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:08:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0973af3a-0c7b-35b6-8a1c-193e5ffd408a","advisory":{"id":"msrc_CVE-2024-32884","description":"gix-transport indirect code execution via malicious username","datePublished":"Aug 16, 2024, 12:00:00 AM","dateUpdated":"Aug 12, 2026, 9:20:38 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-32884.json\n","aliases":"CVE-2024-32884\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"47c45570-363d-3548-9bdb-5b9eb3aa5fd8","product":{"name":"cbl2 rust 1.72.0-10","vendor":{"name":"Microsoft"}}},{"id":"539ffeca-dc46-3178-b5f1-78ed1d9ce696","product":{"name":"rust","vendor":{"name":"rust-lang"}}},{"id":"577f3d74-c193-38dc-995a-5ea7511591a4","product":{"name":"azl3 rust 0:1.75.0-9.azl3","vendor":{"name":"Microsoft"}}},{"id":"5c014062-0bcd-355a-b17e-1bb06502c3dc","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"74a1fe7f-39cd-34e7-9c5e-5c4f67f07221","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"7b501f07-075e-3eab-a5ef-748b8389bb87","product":{"name":"cbl2 rust 0:1.72.0-10.cbl2","vendor":{"name":"Microsoft"}}},{"id":"881f01b6-aa0b-3644-87f6-fa5b33b8d52e","product":{"name":"azl3 rust 1.75.0-9","vendor":{"name":"Microsoft"}}},{"id":"8e7ecd50-6acc-3130-a085-51e70adc4ab0","product":{"name":"azl3 rust 0:1.75.0-14.azl3","vendor":{"name":"Microsoft"}}},{"id":"a0315b05-9c1c-3409-8326-08292c93c515","product":{"name":"cbl2 rust 1.72.0-8","vendor":{"name":"Microsoft"}}},{"id":"a68aaf50-0e56-3249-aa7b-dad2fb21b34b","product":{"name":"azl3 rust 1.86.0-1","vendor":{"name":"Microsoft"}}},{"id":"b3c45632-cb74-3191-805f-8492d8eb0ae7","product":{"name":"cbl2 rust 0:1.72.0-8.cbl2","vendor":{"name":"Microsoft"}}},{"id":"d1ac5025-5e77-3f99-a48f-560fa844d29c","product":{"name":"azl3 rust 0:1.86.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"d85cb4a0-412c-33a4-b8d3-48537a6b0ece","product":{"name":"2.0","vendor":{"name":"Smiths Medical"}}},{"id":"fa3102c2-4ab1-3cc9-ab17-7f2c871ee60c","product":{"name":"azl3 rust 1.75.0-14","vendor":{"name":"Microsoft"}}}]}}]}