Critical Remote Code Execution Vulnerability in libgit2: CVE-2020-12278
Summary
UBUNTU-CVE-2020-12278: An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. Affects libgit2 versions 0.19.0-2 – 0.19.0-2ubuntu0.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It allows developers to embed Git functionality into their applications. However, prior versions of libgit2 are vulnerable to a critical issue that can lead to remote code execution when cloning repositories, particularly due to mishandling of equivalent filenames stemming from NTFS Alternate Data Streams.
Vulnerability Detail
An issue was discovered in libgit2 before version 0.28.4 and in the 0.9x series before 0.99.0. The vulnerability lies in the path.c file, which mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This flaw can be exploited by an attacker to execute arbitrary code on the victim's system when they clone a malicious repository, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid cloning repositories from untrusted sources until the package is updated. Additionally, consider using alternative methods to access Git repositories that do not involve libgit2.
Conclusion
CVE-2020-12278 is a critical vulnerability in libgit2 that poses significant risks through remote code execution. Users are strongly advised to update to the latest patched versions of the library to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2020-12278 is a critical vulnerability in libgit2 that allows for remote code execution due to mishandling of NTFS Alternate Data Streams.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code on the victim's machine.
You can update libgit2 by running the command: sudo apt-get install libgit2=<patched_version> in your terminal.
Yes, avoid cloning repositories from untrusted sources and consider using alternative methods to access Git repositories.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
