N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6mw6-mj76-grwc

GHSA-6mw6-mj76-grwc: gix-date can create non-utf8 string with `TimeBuf::as_str`

The function gix_date::parse::TimeBuf::as_str can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string.

The bug can be prevented by adding str::from_utf8 to the function TimeBuf::write.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6mw6-mj76-grwc

GHSA-6mw6-mj76-grwc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gix-date	rust	< 0.12.0	0.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the gix-date crate because the TimeBuf struct, which is intended to manage a UTF-8 string representation of a date, could be manipulated into holding invalid UTF-8 byte sequences. The core of the issue lies in the implementation of the std::io::Write trait for TimeBuf. The write method within this implementation directly appended raw bytes to an internal buffer without performing any UTF-8 validation.

An attacker could exploit this by providing a specially crafted byte sequence that is not valid UTF-8. Subsequently, when the TimeBuf::as_str method is called, it performs an unsafe conversion of this byte buffer to a &str slice. This operation incorrectly assumes the buffer's contents are valid UTF-8. If they are not, it results in undefined behavior, which could be leveraged to cause memory corruption, denial of service, or other security impacts.

The patch rectifies this vulnerability by completely removing the flawed std::io::Write implementation for TimeBuf. This ensures that data cannot be written to the buffer via this uncontrolled pathway. The Time::to_str function was consequently updated to write directly to the inner Vec<u8> buffer of TimeBuf, thereby bypassing the vulnerable trait implementation and ensuring the data's integrity before any string conversion.

Vulnerable functions

gix_date::parse::TimeBuf::write

gix-date/src/parse/mod.rs

This function, part of the `std::io::Write` trait implementation for `TimeBuf`, is the root cause of the vulnerability. It allows writing arbitrary byte slices into the internal buffer without validating if they are proper UTF-8. This can corrupt the internal state of `TimeBuf`, leading to a violation of its safety invariants.

gix_date::parse::TimeBuf::as_str

gix-date/src/parse/mod.rs

This function unsafely converts the internal byte buffer into a `&str` slice. If the buffer contains invalid UTF-8 bytes (which the vulnerable `write` function allowed), calling `as_str` results in undefined behavior. This is the function where the vulnerability would likely manifest as a crash or memory corruption during exploitation.

gix_date::Time::to_str

gix-date/src/parse/mod.rs

This function is a high-level API that orchestrates the vulnerable sequence. Before the patch, it used `TimeBuf`'s `std::io::Write` implementation (via `self.write_to(buf)`) to serialize the time, and then called `buf.as_str()` to return the string. This sequence directly links the vulnerable write operation with the unsafe `as_str` conversion, making it a key function in the exploit chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.