UBUNTU-CVE-2025-31130
- Source
- https://ubuntu.com/security/CVE-2025-31130
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-31130.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-31130
- Related
- Published
- 2025-04-04T15:15:00Z
- Modified
- 2025-04-23T15:06:09Z
- Summary
- [none]
- Details
-
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
- References
-
- https://ubuntu.com/security/CVE-2025-31130
- https://www.cve.org/CVERecord?id=CVE-2025-31130
- https://rustsec.org/advisories/RUSTSEC-2025-0021.html
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6
- https://github.com/GitoxideLabs/gitoxide/commit/4660f7a6f71873311f68f170b0f1f6659a02829d
Affected packages
Ubuntu:24.10 / rust-gix-features
Package
- Name
- rust-gix-features
- Purl
- pkg:deb/ubuntu/rust-gix-features@0.38.2-1?arch=source&distro=oracular
Ubuntu:24.04:LTS / rust-gix-features
Package
- Name
- rust-gix-features
- Purl
- pkg:deb/ubuntu/rust-gix-features@0.36.1-1?arch=source&distro=noble