Homepage

Improper Preservation of Permissions Affecting rust-gix-worktree-state package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-RUSTGIXWORKTREESTATE-8648358
  • published21 Jan 2025
  • disclosed20 Jan 2025
Report a new vulnerability Found a mistake?

Introduced: 20 Jan 2025

NewCVE-2025-22620  (opens in a new tab)
CWE-281  (opens in a new tab)
CWE-687  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable rust-gix-worktree-state.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-gix-worktree-state package and not the rust-gix-worktree-state package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.