GHSA-2vh6-hw4j-32ww: gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication, network-triggered denial of service.
References
- github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e25aeb8c1
- github.com/GitoxideLabs/gitoxide/pull/2638
- github.com/GitoxideLabs/gitoxide/releases/tag/gix-packetline-v0.21.5
- github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww
- github.com/advisories/GHSA-2vh6-hw4j-32ww
Code Behaviors & Features
Detect and mitigate GHSA-2vh6-hw4j-32ww with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →