gitoxide does not detect SHA-1 collision attacks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.42.0, 0.41.0, 0.27.0, 0.39.0, 0.48.0, and 17 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- GitoxideLabs gitoxide
fixed in 0.42.0
- gix-featurescrates.io
From 0.0.0-0 · fixed in 0.41.0
- gix-featurescrates.io
fixed in 0.41.0
- gix-commitgraphcrates.io
fixed in 0.27.0
- gix-indexcrates.io
fixed in 0.39.0
- gix-objectcrates.io
fixed in 0.48.0
- gix-odbcrates.io
fixed in 0.68.0
- gix-packcrates.io
fixed in 0.58.0
- gitoxidecrates.io
fixed in 0.42.0
- gitoxide-corecrates.io
fixed in 0.46.0
- gixcrates.io
fixed in 0.71.0
- gix-archivecrates.io
fixed in 0.20.0
- gix-blamecrates.io
fixed in 0.1.0
- gix-configcrates.io
fixed in 0.44.0
- gix-diffcrates.io
fixed in 0.51.0
- gix-dircrates.io
fixed in 0.13.0
- gix-discovercrates.io
fixed in 0.39.0
- gix-filtercrates.io
fixed in 0.18.0
- gix-fsckcrates.io
fixed in 0.10.0
- gix-mergecrates.io
fixed in 0.4.0
- gix-negotiatecrates.io
fixed in 0.19.0
- gix-protocolcrates.io
fixed in 0.49.0
- gix-refcrates.io
fixed in 0.51.0
- gix-revisioncrates.io
fixed in 0.33.0
- gix-revwalkcrates.io
fixed in 0.19.0
- gix-statuscrates.io
fixed in 0.18.0
- gix-traversecrates.io
fixed in 0.45.0
- gix-worktreecrates.io
fixed in 0.40.0
- gix-worktree-statecrates.io
fixed in 0.18.0