Denial of Service Vulnerability in libgit2: CVE-2016-8568
Summary
UBUNTU-CVE-2016-8568: The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file. Affects libgit2 versions < 0.19.0-2ubuntu0.4+esm1. Fixed in 0.19.0-2ubuntu0.4+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It allows developers to integrate Git functionalities into their applications. The library is widely used for version control in various software projects. However, a vulnerability has been identified that could allow remote attackers to exploit the library, leading to potential service disruptions.
Vulnerability Detail
The git_commit_message function in oid.c within libgit2 versions prior to 0.24.3 is vulnerable to a denial of service attack. This vulnerability arises when a remote attacker sends a crafted object file through a cat-file command, which can trigger an out-of-bounds read. This could lead to unexpected behavior or crashes in applications utilizing the library, compromising the stability and reliability of the software.
How To Fix
Minimum fixed version
0.19.0-2ubuntu0.4+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider restricting access to the affected functionalities of libgit2 until the patch is applied. This can be done by modifying the application code to prevent the execution of the git_commit_message function with untrusted input.
Conclusion
CVE-2016-8568 represents a significant vulnerability in libgit2 that can lead to denial of service attacks. Users are strongly advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2016-8568 is a vulnerability in libgit2 that allows remote attackers to cause a denial of service through an out-of-bounds read.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2016-8568 is 5.5, indicating a medium severity level.
The vulnerability can lead to application crashes or unexpected behavior, affecting the stability of software that relies on libgit2.
Yes, a patched version of libgit2 is available. Users should update to version 0.24.1-2ubuntu0.2+esm1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
