gix-path improperly resolves configuration path reported by Git

{
  "id": "271b65563ecb79b049101599de0093b859efd449028ed8e793c9cca3b0a5345d",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2024-0371",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "gix-path improperly resolves configuration path reported by Git",
    "summary": "### Summary `gix-path` runs `git` to find the path of a configuration file associated with the `git` installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. ### Details In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` to find the path of a file to treat as belonging to the `git` installation. Affected versions of `gix-path` do not pass `-z`/`--null` to cause `git` to report literal paths ([`650a1b5`](https://github.com/Byron/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031)). Instead, to cover the occasional case that `git` outputs a quoted path, they attempt to parse the path by stripping the quotation marks: The problem is that, when a path is quoted, it may change in substantial ways beyond the concatenation of quotation marks. If not reversed, these changes can result in another valid path that is not equivalent to the original. This is not limited to paths with unusual characters such as quotation marks or newlines. Unless `git` is explicitly configured with `core.quotePath` set to `false`, it also happens when the path contains most non-ASCII characters, including accented or non-English letters. For example, `é` is transformed to `\\303\\251`, with literal backslashes. (This is an octal representation of the bytes in its UTF-8 encoding",
    "evidence": "osv:RUSTSEC-2024-0371",
    "products": [
      {
        "name": {
          "value": "gix-path",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.10.11",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RUSTSEC-2024-0371",
      "aliases": [
        "CVE-2024-45405",
        "GHSA-m8rp-vv92-46c7",
        "RUSTSEC-2024-0371"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.0.0-0"
                },
                {
                  "fixed": "0.10.11"
                }
              ]
            }
          ],
          "package": {
            "name": "gix-path",
            "purl": "pkg:cargo/gix-path",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0371.json",
            "categories": [
              "code-execution",
              "privilege-escalation"
            ],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [],
              "functions": [
                "gix_path::env::installation_config",
                "gix_path::env::installation_config_prefix"
              ]
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-12T18:00:12.400489890Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/gix-path",
        "https://rustsec.org/advisories/RUSTSEC-2024-0371.html",
        "https://github.com/Byron/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031",
        "https://github.com/advisories/GHSA-m8rp-vv92-46c7"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-45405",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 306423,
  "published_at": "2024-09-06T12:00:00+00:00"
}