VulnerabilityDeferred

CVE-2024-51990

jj, or Jujutsu, is a Git-compatible VCS written in rust.

CRITICAL 9.3EPSS 0.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.61% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: security-advisories@github.com

References

https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.