CVE-2020-12278 — Improper Input Validation in Libgit2

CWE-20 — Improper Input ValidationCWE-706 — Use of Incorrectly-Resolved Name or ReferenceCWE-73 — External Control of File Name or Path13 documents7 sources
Severity
9.8CRITICALNVD
OSV8.8
EPSS
6.0%
top 9.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libgit2Debian Libgit2Debian Linux
Timeline
PublishedApr 27
Latest updateMar 5

Description

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/libgit2< libgit2 0.28.4+dfsg.1-2 (bookworm)
▶NVDlibgit2/libgit2< 0.28.4
▶Debianlibgit2/libgit2< 0.28.4+dfsg.1-2+3
▶Ubuntulibgit2/libgit2< 0.28.4+dfsg.1-2ubuntu0.1+3

Also affects: Debian Linux 9.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
libgit2 vulnerabilities↗2024-03-05
▶
GHSA
GHSA-w32v-c4gg-xc8p: An issue was discovered in libgit2 before 0↗2022-05-24
▶
OSV
CVE-2020-12278: An issue was discovered in libgit2 before 0↗2020-04-27
▶

📋Vendor Advisories

3
Ubuntu
libgit2 vulnerabilities↗2024-03-05
▶
Debian
CVE-2020-12278: libgit2 - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c ...↗2020
▶
Red Hat
libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams↗2019-09-18
▶

💬Community

6
Bugzilla
CVE-2020-12278 libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]↗2020-04-29
▶
Bugzilla
CVE-2020-12278 libgit2:0.28/libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]↗2020-04-29
▶
Bugzilla
CVE-2020-12278 libgit2:0.27/libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]↗2020-04-29
▶
Bugzilla
CVE-2020-12278 libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [epel-all]↗2020-04-29
▶
Bugzilla
CVE-2020-12278 libgit2:0.26/libgit2: files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]↗2020-04-29
▶