Denial of Service Vulnerability in libgit2: CVE-2016-10129
Summary
ALPINE-CVE-2016-10129: The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line. Affects libgit2 versions < 0.25.1-r0. Fixed in 0.25.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a focus on performance and flexibility. It allows developers to integrate Git functionalities into their applications seamlessly. However, certain versions of libgit2 are vulnerable to a denial of service attack due to improper handling of packet lines in the Git Smart Protocol.
Vulnerability Detail
The vulnerability identified as CVE-2016-10129 affects libgit2 versions prior to 0.24.6 and 0.25.x before 0.25.1. It allows remote attackers to exploit the library by sending an empty packet line, leading to a NULL pointer dereference and causing a denial of service. This can disrupt the functionality of applications relying on libgit2, making them unresponsive or crashing them entirely.
How To Fix
Minimum fixed version
0.25.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version of libgit2.
Conclusion
CVE-2016-10129 is a significant vulnerability in libgit2 that can lead to denial of service attacks. It is crucial for users of affected versions to update to the patched versions to ensure the security and stability of their applications.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2016-10129 is a vulnerability in libgit2 that allows remote attackers to cause a denial of service by sending an empty packet line.
Versions of libgit2 prior to 0.24.6 and 0.25.x before 0.25.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to a denial of service, making applications that depend on libgit2 unresponsive or crashing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-10129 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
