RUSTSEC-2024-0335: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2024-0335) affects gitoxide, a pure Rust implementation of Git. The issue lies in the gix-transport component, which fails to properly validate the username portion of URLs for SSH command options. This vulnerability was discovered and disclosed in April 2024, affecting multiple versions of the software packages including gitoxide (<0.35), gix (<0.62), and gix-transport (<0.42.0). (GitHub Advisory)

The vulnerability stems from gix-transport's insufficient URL validation, specifically in the username part of SSH URLs. While the component checks host and path portions for potentially dangerous characters, it overlooks the username section. When processing URLs in the format ssh://username@hostname/path or username@hostname:dirs/repo, the system passes the username directly to the SSH command without proper sanitization. This can lead to option injection if the username begins with a hyphen. The vulnerability is tracked with a CVSS v3.1 score of 6.4 (Medium), with a vector string of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L. (GitHub Advisory)

The vulnerability's impact is constrained by several factors, including the requirement for user interaction to trigger a malicious URL clone and the need for preparatory steps to establish specially named files in the current directory. Users are particularly at risk when working with repositories containing automatically added submodules, operating on other repositories from within an untrusted repository, or when reviewing contributions from untrusted developers by checking out branches from untrusted forks. (GitHub Advisory)

The vulnerability has been patched in multiple versions: gitoxide version 0.35.0 and later, gix version 0.62.0 and later, and gix-transport version 0.42.0 and later. Users are strongly advised to upgrade to these patched versions to mitigate the risk. (GitHub Advisory)