crates.io/gix-path CVE-2024-40644: medium 6.8, EPSS 0.21%
gix-path can use a fake program files location
Action: Upgrade gix-path to 0.10.9 or later.
cargo update -p gix-path --precise 0.10.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.10.8 | 0.10.9 | - |
Fixed versions
| 0.10.9 |
Sources
- osv: GHSA-mgvv-9p9g-3jv4
- https://github.com/Byron/gitoxide/security/advisories/GHSA-mgvv-9p9g-3jv4
- https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2
- https://github.com/Byron/gitoxide
- https://github.com/Byron/gitoxide/blob/6cd8b4665bb7582f744c3244abaef812be39ec35/gix-path/src/env/git.rs#L9-L14
CVE-2024-40644 · published · modified · JSON