gix-packetline Panic via Empty Side-Band Packet

Executive Summary

This vulnerability affects gitoxide's gix-packetline library before version 0.21.5. It involves a panic triggered when processing side-band packet lines with empty payloads in the TextRef implementation. A malicious Git server can exploit this to send a crafted packet, causing an index out of bounds error that crashes the client during fetch operations without requiring authentication.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the version of gitoxide gix-packetline. If the version is before 0.21.5, the system is vulnerable. Use commands like 'cargo tree -p gix-packetline' or 'gitoxide --version' to check the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of gitoxide, an attacker could crash your Git client during fetch operations by sending a specially crafted packet. This could disrupt your workflow and potentially lead to denial of service if the client process terminates unexpectedly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update gitoxide gix-packetline to version 0.21.5 or later. If using a package manager, run 'cargo update -p gix-packetline' or update via your system's package manager. Avoid fetching from untrusted Git servers until patched.

Useful 0 Not Useful 0