« Volver al listado

CVE-2025-31130

Estado: AplazadaMedia (6.8)—

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gitoxide — GitoxideAISha1 — Sha1AISha1 Smol — Sha1 SmolAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-31130",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31130",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-04T14:51:46.167954Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "GitoxideLabs",
          "product": "gitoxide",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.42.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-04T15:15:48.320",
  "references": [
    {
      "url": "https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-328"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0."
    },
    {
      "lang": "es",
      "value": "Gitoxide es una implementación de Git escrita en Rust. Antes de la versión 0.42.0, Gitoxide utilizaba implementaciones de hash SHA-1 sin detección de colisiones, lo que lo hacía vulnerable a ataques de colisión de hash. Gitoxide utiliza la caja sha1_smol o sha1, que implementan SHA-1 estándar sin mitigaciones para ataques de colisión. Esto significa que dos objetos Git distintos con hashes SHA-1 en colisión interrumpirían el modelo de objetos Git y las comprobaciones de integridad al usarse con Gitoxide. Esta vulnerabilidad se corrigió en la versión 0.42.0."
    }
  ],
  "lastModified": "2026-06-17T09:09:54.553",
  "sourceIdentifier": "security-advisories@github.com"
}