Integer Overflow Vulnerability in libgit2 Leading to Potential Memory Leak and Denial of Service
Summary
ALPINE-CVE-2018-10887: A flaw was found in libgit2 before version 0.27.3. Affects libgit2 versions < 0.27.3-r0. Fixed in 0.27.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is designed to be used in applications that require Git functionality without the overhead of a full Git installation. This library is widely used in various applications for version control and source code management. However, prior to version 0.27.3, libgit2 contained a critical vulnerability that could lead to severe security issues.
Vulnerability Detail
A flaw was found in libgit2 before version 0.27.3. An unexpected sign extension in the git_delta_apply function within the delta.c file may lead to an integer overflow. This overflow can result in an out-of-bounds read, allowing attackers to read memory addresses before the base object. The ramifications include potential memory leaks and Denial of Service (DoS) attacks, making it crucial for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
0.27.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functions in libgit2 until the package is updated. However, this may limit the functionality of applications relying on libgit2.
Conclusion
The integer overflow vulnerability in libgit2 prior to version 0.27.3 poses significant risks, including memory leaks and Denial of Service attacks. Users are strongly advised to update to the patched version to ensure the security and stability of their applications.
See every vulnerability recorded for libgit2 →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include memory leaks and Denial of Service (DoS) attacks, which can disrupt application functionality and compromise security.
Yes, you should upgrade to version 0.27.3-r0 or later to mitigate this vulnerability.
libgit2 is used for providing Git functionality in applications, allowing developers to manage version control and source code without needing a full Git installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
