{"schemaVersion":3,"id":"CVE-2024-45305","aliases":["UBUNTU-CVE-2024-45305","DEBIAN-CVE-2024-45305","CGA-4jv6-8r8j-r998","CGA-8gg3-cqmh-r8pj","CGA-jvp3-fx4w-5vwx","CGA-qwg6-vqrf-6hhj","CGA-vmq8-wj6w-3c34","CGA-xcxp-43qr-w8c9","GHSA-v26r-4c9c-h3j6","RUSTSEC-2024-0367"],"status":"published","duplicateOf":null,"title":null,"description":"gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade.","dates":{"published":"2024-09-02T16:30:25.446Z","modified":"2024-09-03T14:12:44.258Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":2.5,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":2.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":2.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":2.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":2.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":2.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":2.5,"severity":"low","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00244,"percentile":0.14669,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00244},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00244,"percentile":0.14669}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00244,"percentile":0.14669}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference","description":"The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/706.html"}],"affected":[{"vendor":"chainguard","product":"cargo-audit","name":"cargo-audit","label":"cargo-audit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cargo-audit","purlType":"apk","versions":[{"text":"< 0.21.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.21.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cargo-c","name":"cargo-c","label":"cargo-c","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cargo-c","purlType":"apk","versions":[{"text":"< 0.10.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.23-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"starship","name":"starship","label":"starship","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/starship","purlType":"apk","versions":[{"text":"< 1.22.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cargo-audit","name":"cargo-audit","label":"cargo-audit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cargo-audit","purlType":"apk","versions":[{"text":"< 0.21.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.21.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cargo-c","name":"cargo-c","label":"cargo-c","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cargo-c","purlType":"apk","versions":[{"text":"< 0.10.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.23-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"starship","name":"starship","label":"starship","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/starship","purlType":"apk","versions":[{"text":"< 1.22.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.1-r0","eol":null,"hubHref":null},{"vendor":"byron","product":"gitoxide","name":"gitoxide","label":"gitoxide","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.10.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.10","eol":null,"hubHref":"/vendor/byron/gitoxide"},{"vendor":"Crates.Io","product":"gix-path","name":"gix-path","label":"gix-path","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-path","purlType":"cargo","versions":[{"text":"< 0.10.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.0.0-0, < 0.10.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.10 | ≥ 0.0.0-0, < 0.10.10","eol":null,"hubHref":null},{"vendor":"debian","product":"rust-gix-path","name":"rust-gix-path","label":"rust-gix-path","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/rust-gix-path","purlType":"deb","versions":[{"text":"< 0.10.11-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.11-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"rust-gix-path","name":"rust-gix-path","label":"rust-gix-path","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rust-gix-path","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":10,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6","label":"github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB"]},{"url":"https://git-scm.com/docs/git-config#SCOPES","label":"git-scm.com/docs/git-config","hostname":"git-scm.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L112","label":"github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L91","label":"github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://ubuntu.com/security/CVE-2024-45305","label":"ubuntu.com/security/CVE-2024-45305","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45305","label":"www.cve.org/CVERecord?id=CVE-2024-45305","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45305","label":"security-tracker.debian.org/tracker/CVE-2024-45305","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45305.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45305.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45305","label":"nvd.nist.gov/vuln/detail/CVE-2024-45305","hostname":"nvd.nist.gov","tags":["Advisory","WEB"]},{"url":"https://github.com/Byron/gitoxide","label":"github.com/Byron/gitoxide","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0367.html","label":"rustsec.org/advisories/RUSTSEC-2024-0367.html","hostname":"rustsec.org","tags":["WEB","Advisory"]},{"url":"https://crates.io/crates/gix-path","label":"crates.io/crates/gix-path","hostname":"crates.io","tags":["PACKAGE"]},{"url":"https://github.com/Byron/gitoxide/commit/12251eb052df30105538fa831e641eea557f13d8","label":"github.com/Byron/gitoxide/commit/12251eb052df30105538fa831e641eea557f13d8","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/advisories/GHSA-v26r-4c9c-h3j6","label":"github.com/advisories/GHSA-v26r-4c9c-h3j6","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":["CVE-2024-8371"],"related":["CGA-H7J4-PV5F-96MH","CGA-JJM7-PHRF-RHGM","CGA-R243-3M2Q-V3MR","CGA-R3G2-X65F-95W4"]},"timeline":[{"kind":"published","date":"2024-09-02T16:30:25.446Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-03T14:12:44.258Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":10,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T12:46:53.490Z","stale":false,"partial":false}}