Buffer Overflow Vulnerability in rust-eza Package
Summary
DEBIAN-CVE-2024-25817: Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components. Affects rust-eza versions < 0.18.2-1. Fixed in 0.18.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-eza package is a Rust implementation of the 'eza' command-line tool, designed to enhance the usability of the 'ls' command by providing additional features and improved formatting. It is widely used in various applications for file management and directory listing. However, prior to version 0.18.2, rust-eza is susceptible to a buffer overflow vulnerability that can be exploited by local attackers.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2024-25817, originates from improper handling of certain components within the rust-eza package, specifically the .git/HEAD, .git/refs, and .git/objects files. This flaw allows local attackers to execute arbitrary code, potentially leading to unauthorized access and control over the affected system. The risk is particularly concerning as it can be exploited without requiring elevated privileges, making it accessible to any local user.
How To Fix
Minimum fixed version
0.18.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rust-ezaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the vulnerable components by modifying file permissions or removing the .git directory from the affected projects. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The rust-eza package has a critical buffer overflow vulnerability that can be exploited by local attackers to execute arbitrary code. It is essential to update to version 0.18.2-1 or later to mitigate this risk. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for rust-eza →
FAQ
A buffer overflow vulnerability occurs when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior or security breaches.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Failing to fix this vulnerability may allow local attackers to execute arbitrary code, which could compromise the integrity and security of your system.
Yes, you can temporarily restrict access to the vulnerable components or remove the .git directory, but these are not long-term solutions.
You can visit Vulert at https://vulert.com, which provides real-time monitoring and alerts for open-source vulnerabilities using a manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-eza.
