Out-of-Bounds Read Vulnerability in libgit2
Summary
CVE-2016-8568: The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file. Affects libgit2 across 2 version ranges.
< 0.24.3-r0
< 4cf1ec7cff28da8838a2f0a9fb330e312ea3f963
Fixed in 0.24.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libgit2 is an open-source library that provides a low-level API for interacting with Git repositories. It is used by various applications and tools to perform Git operations programmatically. This vulnerability, identified as CVE-2016-8568, affects versions of libgit2 prior to 0.24.3. The vulnerability allows remote attackers to cause a denial of service by exploiting an out-of-bounds read issue in the git_commit_message function of the oid.c file. This can be achieved by sending a crafted object file through a cat-file command.
Vulnerability Detail
The vulnerability arises from a flaw in the git_commit_message function of libgit2. By manipulating a cat-file command with a specially crafted object file, an attacker can trigger an out-of-bounds read, leading to a denial of service condition. This vulnerability can potentially be exploited remotely, and its impact is limited to causing a service outage.
How To Fix
Minimum fixed version
0.24.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
The out-of-bounds read vulnerability in libgit2 can be mitigated by updating the package to version 0.24.3 or later. It is recommended to apply the update as soon as possible to prevent potential denial of service attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgit2 →
FAQ
libgit2 is an open-source library that provides a low-level API for interacting with Git repositories. It is widely used by developers and various tools to perform Git operations programmatically.
The vulnerability allows remote attackers to cause a denial of service by exploiting an out-of-bounds read issue in the git_commit_message function of libgit2. This can result in a service outage.
To fix this vulnerability, update the libgit2 package to version 0.24.3 or later. This update includes a patch that addresses the out-of-bounds read issue.
No known workarounds are available for this vulnerability.
Yes, this vulnerability can be exploited remotely by sending a crafted object file through a cat-file command.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
