Threats affecting pkg:cargo/gix-index

CVE-2024-35197 is a vulnerability in the gix-index component on Windows where repository references or file paths that use reserved Windows device names (e.g., CON, CONIN$, CONOUT$, COM1) can cause unintended device access. Cloning a malicious repository can lead to indefinite blocking by reading from the console device or writing arbitrary attacker-controlled data to devices such as the console or serial ports. This can result in denial of service or deceptive console output that may facilitate social engineering. The issue affects versions prior to 0.33.0 and has been fixed in version 0.33.0.

CVE-2024-35186 is a vulnerability in gix-index where the software does not properly verify that file paths during checkout remain within the working tree. This allows specially crafted repositories to create or overwrite files outside the intended directory, including in locations where arbitrary code execution can occur, such as .git hooks. The flaw arises from insufficient path validation, enabling directory traversal via tree or blob names containing '..', '.git', or path separators. A fix is available in version 0.33.0.