Denial of Service Vulnerability in libgit2: CVE-2018-8099
Summary
UBUNTU-CVE-2018-8099: Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file. Affects libgit2 versions 0.19.0-2 – 0.19.0-2ubuntu0.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is widely used in various applications for version control and repository management. The vulnerability CVE-2018-8099 affects multiple versions of libgit2, specifically versions prior to 0.26.2, allowing attackers to exploit the library through crafted repository index files.
Vulnerability Detail
The vulnerability arises from an incorrect error code return in the index.c:read_entry() function, which leads to a double free scenario in libgit2. This flaw can be exploited by an attacker to cause a denial of service, potentially crashing applications that rely on the library. The issue is critical as it can disrupt services and lead to application instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted repository index files until the library is updated. This can help mitigate the risk of exploitation while waiting for a patch.
Conclusion
CVE-2018-8099 represents a significant vulnerability in libgit2 that can lead to denial of service. Users are strongly advised to update to the latest version to protect their applications from potential exploitation. Utilizing tools like Vulert can assist in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2018-8099 is a vulnerability in libgit2 that allows for denial of service due to a double free error in the library's code.
Versions of libgit2 prior to 0.26.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid processing untrusted repository index files to mitigate the risk of exploitation.
The CVSS score for CVE-2018-8099 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
