Denial of Service Vulnerability in libgit2 - CVE-2016-8569
Summary
ALPINE-CVE-2016-8569: The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file. Affects libgit2 versions < 0.24.3-r0. Fixed in 0.24.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is designed to be used in applications that require Git functionality without the overhead of the Git command line. This library is widely used in various applications for version control and source code management. However, prior to version 0.24.3, libgit2 contained a vulnerability that could be exploited by remote attackers.
Vulnerability Detail
The vulnerability arises from the git_oid_nfmt function in commit.c within libgit2 versions before 0.24.3. It allows remote attackers to trigger a denial of service (DoS) through a crafted object file when executing a cat-file command. This results in a NULL pointer dereference, causing the application to crash. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.24.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the cat-file command with untrusted object files until the library is updated. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The vulnerability CVE-2016-8569 in libgit2 poses a risk of denial of service due to a NULL pointer dereference. It is crucial for users to update to version 0.24.3 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2016-8569 is a vulnerability in libgit2 that allows remote attackers to cause a denial of service through a crafted object file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to application crashes, resulting in denial of service for users relying on the affected software.
Yes, the vulnerability is fixed in libgit2 version 0.24.3 and later. Updating to this version will resolve the issue.
If immediate updates are not possible, avoid using vulnerable commands with untrusted inputs as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
