{"id":"GHSA-cx7h-h87r-jpgr","aliases":["RUSTSEC-2024-0359"],"status":"published","title":"The kstring integration in gix-attributes is unsound","description":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `\u0026str` from a `\u0026[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `\u0026str` and relies on it being UTF-8 in the `\u0026str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `\u0026str`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-172"],"published":"2024-07-24T12:00:00Z","modified":"2026-09-10T03:50:16Z","fixes":[{"ecosystem":"crates.io","package":"gix-attributes","fixed_in":["0.22.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"gix-attributes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"gix-attributes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"gix-attributes","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.22.3"}]}]}],"references":[{"url":"https://github.com/Byron/gitoxide/issues/1460","tags":["web"]},{"url":"https://github.com/rustsec/advisory-db/commit/884aaa1646132bc3a27ba058197d6ef039bec294","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0359.html","tags":["web","advisory"]},{"url":"https://github.com/GitoxideLabs/gitoxide/issues/1460","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-cx7h-h87r-jpgr"},{"url":"https://github.com/Byron/gitoxide","tags":["package"]},{"url":"https://crates.io/crates/gix-attributes","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-cx7h-h87r-jpgr","title":"The kstring integration in gix-attributes is unsound","description":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `\u0026str` from a `\u0026[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `\u0026str` and relies on it being UTF-8 in the `\u0026str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `\u0026str`.\n","status":"published","published":"2024-07-25T16:38:42Z","modified":"2025-01-21T18:18:43Z","cwes":["CWE-172"],"updated_at":"2026-11-02T14:38:27.974809Z"}],"osv":[{"id":"GHSA-cx7h-h87r-jpgr","title":"The kstring integration in gix-attributes is unsound","description":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `\u0026str` from a `\u0026[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `\u0026str` and relies on it being UTF-8 in the `\u0026str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `\u0026str`.\n","status":"published","published":"2024-07-25T16:38:42Z","modified":"2026-09-10T03:50:16.580555746Z","cwes":["CWE-172"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RUSTSEC-2024-0359","title":"The kstring integration in gix-attributes is unsound","description":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `\u0026str` from a `\u0026[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `\u0026str` and relies on it being UTF-8 in the `\u0026str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `\u0026str`.\n\n*Thanks to [Devin Jeanpierre](https://github.com/ssbr) for discovering and reporting this issue.*","status":"published","published":"2024-07-24T12:00:00Z","modified":"2025-01-19T00:59:32.710269Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}