GHSA-cx7h-h87r-jpgr

Source

https://github.com/advisories/GHSA-cx7h-h87r-jpgr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-cx7h-h87r-jpgr/GHSA-cx7h-h87r-jpgr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cx7h-h87r-jpgr

Published

2024-07-25T16:38:42Z

Modified

2024-07-25T16:38:42Z

Summary

The kstring integration in gix-attributes is unsound

Details

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-172"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-25T16:38:42Z"
}

References

Affected packages

crates.io / gix-attributes

Package

Name: gix-attributes; View open source insights on deps.dev
Purl: pkg:cargo/gix-attributes

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.22.3