by Kastro
Paper/Archive/CVE-2024-51990

CVE-2024-51990

martinvonz jj — Path traversal via crafted Git repositories in jj

EPSS 0.6%public exploitCVSS 9.3
critical.is priorityof 100
48
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 49.5.495 × 209.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

Affected

ProductAffectedFixed inSource
jj< 0.23.0–CNA
jj< 0.23.00.23.0CISA-ADP

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56