GHSA-2vh6-hw4j-32ww: gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication, network-triggered denial of service.
References
- github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e25aeb8c1
- github.com/GitoxideLabs/gitoxide/pull/2638
- github.com/GitoxideLabs/gitoxide/releases/tag/gix-packetline-v0.21.5
- github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww
- github.com/advisories/GHSA-2vh6-hw4j-32ww
Code Behaviors & Features
Detect and mitigate GHSA-2vh6-hw4j-32ww with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →