GHSA-rrjw-j4m2-mf34
gix-transport code execution vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | gix-transport | < 0.36.1 | 0.36.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.
PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`.
Thanks for [vin01](https://github.com/vin01) for disclosing this issue.
References
External links from the advisory. They lead to third-party sites.