CVE-2024-32884

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-77 CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-328864.9Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into CVE-2024-328875.5Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflec CVE-2024-3288810.0The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application progra CVE-2024-32897.8When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce sec CVE-2024-328906.1librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information CVE-2024-328917.0In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of pri CVE-2024-328927.8In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of pr CVE-2024-328935.5In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2024-328947.5In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2024-328957.8In BCMFASTPATH of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o CVE-2024-328967.8there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional exe CVE-2024-328975.9In ProtocolCdmaCallWaitingIndAdapter::GetCwInfo() of protocolsmsadapter.cpp, there is a possible out of bounds read due to a missing bounds