Exposure of Resource to Wrong Sphere Affecting gix-path package, versions <0.10.10
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-GIXPATH-7856143
- published 2 Sep 2024
- disclosed 31 Aug 2024
- credit Eliah Kagan
Introduced: 31 Aug 2024
CVE-2024-45305 Open this link in a new tabHow to fix?
Upgrade gix-path to version 0.10.10 or higher.
Overview
gix-path is a gitoxide project crate dealing paths and their conversions
Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to the misinterpretation of local repository configuration as system-wide configuration. An attacker can manipulate the configuration to leak sensitive information or misdirect operations by setting specific environment variables to alter the scope of configuration considered.