Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade version of gix-transport to fix security vulnerability
Summary: When trying to vendor-in a new crate, I saw the following text about a vulnerability regarding the version of `gix-transport` that we use: ``` VULNERABILITY RUSTSEC-2023-0064 - 2023-09-23: gix-transport code execution vulnerability Package: gix-transport 0.34.2 The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution. PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'` This will launch a calculator on OSX. ``` This diff tries to update the version so we don't have to deal with this vulnerability Reviewed By: liubov-dmitrieva Differential Revision: D53223416 fbshipit-source-id: d1a11eea9d6f22d1fdfe53aa6d3c37fd8b4e6d3c
- Loading branch information