CVE-2025-31130

MEDIUM Year: 2025
CVSS v3 Score
6.8
Medium
Weakness Type
CWE-328
View all →

Vulnerability Description

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

Related Vulnerabilities

CVE-2024-23589

MEDIUM
CVSS:6.8(Medium)

Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modern hardware such as GPUs or ASICs

CWE-3282024

CVE-2022-3433

MEDIUM
CVSS:6.5(Medium)

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending speciall...

CWE-3282022

CVE-2023-5962

MEDIUM
CVSS:6.5(Medium)

A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sen...

CWE-3282023

CVE-2024-47829

MEDIUM
CVSS:6.5(Medium)

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same ...

CWE-3282024

CVE-2023-2900

HIGH
CVSS:7.5(High)

A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to ...

CWE-3282023

CVE-2024-47182

HIGH
CVSS:7.5(High)

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches t...

CWE-3282024