Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

gix-transport

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8crates.ioPublished

    gix-transport: HTTP credentials leaked to redirected host in curl backend

    GHSA-9857-6mw7-fq2m

    Affected
    • crates.io gix-transport >= 0.25.4, <= 0.55.0
    Fixed in
    0.56.0· Vendor fix available
    Issue
    The curl-based HTTP transport in gix-transport sends user credentials (passwords, tokens) to an attacker-controlled server after an HTTP redirect. When a server responds with a 302 redirect during the initial GET /info/refs, gitoxide records the redirected base URL and rewrites all subsequent requests to point at the redirected host. The Authorization header is still attached because addbasicauthifpresent() only checks self.url (the original, never-updated URL). The reqwest backend is not affected. Its custom redirect policy at reqwest/remote.rs lines 60-64 compares prevurl.hoststr() to currurl.hoststr() and calls attempt.stop() on cross-domain redirects, so redirectedbaseurl is never set to a different host. Details The vulnerability involves two components in gix-transport: 1. URL rewriting after redirect (gix-transport/src/client/blockingio/http/curl/remote.rs) After a request completes, the effective URL is compared to the requested URL. If they differ (redirect…

    Recommended action: Upgrade to 0.56.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.1crates.ioPublished

    gix-transport code execution vulnerability

    CVE-2023-53158 · GHSA-rrjw-j4m2-mf34

    Affected
    • crates.io gix-transport < 0.36.1
    Fixed in
    0.36.1· Vendor fix available
    Issue
    The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution. PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo' This will launch a calculator on OSX. See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git. Thanks for vin01 for disclosing this issue.

    Recommended action: Upgrade to 0.36.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →