Critical Remote Code Execution Vulnerability in libgit2: CVE-2020-12279
Summary
UBUNTU-CVE-2020-12279: An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. Affects libgit2 versions 0.19.0-2 – 0.19.0-2ubuntu0.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is widely used in various applications for version control and repository management. The library is designed to be efficient and lightweight, making it suitable for embedding in applications. However, it has been found vulnerable to a critical issue that can lead to remote code execution under specific conditions.
Vulnerability Detail
An issue was discovered in libgit2 versions before 0.28.4 and 0.9x before 0.99.0, specifically in the checkout.c file. This vulnerability arises from the mishandling of equivalent filenames that exist due to NTFS short names. An attacker could exploit this flaw when a user clones a repository containing maliciously crafted filenames, potentially leading to remote code execution. This vulnerability is similar to CVE-2019-1353 and has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid cloning repositories from untrusted sources or those that may contain malicious filenames until the package is updated to a secure version.
Conclusion
The vulnerability CVE-2020-12279 in libgit2 poses a significant risk due to its potential for remote code execution. Users are strongly advised to update their libgit2 packages to the latest patched versions to safeguard their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2020-12279 is a critical vulnerability in libgit2 that allows for remote code execution due to mishandling of NTFS short names.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2020-12279 using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the affected system.
Yes, a patched version of libgit2 is available. Users should update to version 0.28.4 or later to mitigate the risk.
If immediate updates are not possible, avoid cloning repositories from untrusted sources as a temporary measure until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
