Skip to content
Fencer Intel
medium 6.4

CVE-2024-32884 json

gix-transport indirect code execution via malicious username

published 2y ago modified 30d ago also GHSA-98p4-xjmm-8mfh , RUSTSEC-2024-0335 , EUVD-2024-1168

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

Patch / fix

  • crates.io gix-transport 0.42.0
  • crates.io gix 0.62
  • crates.io gitoxide 0.35
  • Byron gitoxide 0.35.0, 0.42.0, 0.62.0
  • rust Azure Linux 3.0 1.75.0-9
  • rust CBL-Mariner 2.0 1.72.0-8

azure linux advisories AZL-40229AZL-40264

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2024-32884 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
GitHub 3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Affected packages

ecosystem package affected fixed in
crates.io gix-transport
<0.42.0
>=0.0.0-0, <0.42.0
0.42.0
crates.io gix
<0.62
0.62
crates.io gitoxide
<0.35
0.35

Affected products

  • Byron gitoxide

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.