RUSTSEC-2023-0064: gix-transport code execution vulnerability

[github-actions]

gix-transport code execution vulnerability

Details
Package	gix-transport
Version	0.33.1
URL	Byron/gitoxide#1032
Date	2023-09-23
Patched versions	>=0.36.1

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to
use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading
to arbitrary code execution.

PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.

Thanks for vin01 for disclosing the issue.

See advisory page for additional details.

[syphar]

resolved in #2233