OESA-2021-1282

Dashboard / Vulnerabilities / OESA-2021-1282

OESA-2021-1282

Summary: libgit2 security update

Details: libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fix(es): An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.(CVE-2020-12278) An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.(CVE-2020-12279)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1282, https://nvd.nist.gov/vuln/detail/CVE-2020-12278, https://nvd.nist.gov/vuln/detail/CVE-2020-12279