Critical Buffer Overflow Vulnerability in libgit2: CVE-2016-10128
Summary
ALPINE-CVE-2016-10128: Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a cr... Affects libgit2 versions < 0.25.1-r0. Fixed in 0.25.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is widely used in various applications for version control and repository management. The library's functionality includes support for the Git Smart Protocol, which allows for efficient communication between clients and servers. However, it is susceptible to a buffer overflow vulnerability that can be exploited by remote attackers, potentially leading to severe security implications.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10128, originates from a buffer overflow in the git_pkt_parse_line function within the transports/smart_pkt.c file of libgit2. This flaw allows remote attackers to exploit crafted non-flush packets, leading to unspecified impacts such as data corruption, unauthorized access, or denial of service. The vulnerability affects versions of libgit2 prior to 0.24.6 and 0.25.x before 0.25.1, with a CVSS score of 9.8 indicating its critical nature.
How To Fix
Minimum fixed version
0.25.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the Git Smart Protocol if feasible, or implementing network-level controls to restrict access to the affected services until the library can be updated.
Conclusion
The buffer overflow vulnerability CVE-2016-10128 in libgit2 poses significant risks to applications utilizing this library. It is crucial for users to update to the patched versions to mitigate potential exploitation. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2016-10128 is a critical buffer overflow vulnerability in libgit2 that can be exploited by remote attackers through crafted packets.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to data corruption, unauthorized access, or denial of service, posing significant risks to applications using libgit2.
You can update libgit2 using the command 'apk add libgit2=0.25.1-r0' to ensure you are using a patched version.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file. It provides real-time alerts and insights into potential vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
