CVE-2020-12278
Published: 27 April 2020
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libgit2 Launchpad, Ubuntu, Debian |
bionic |
Released
(0.26.0+dfsg.1-1.1ubuntu0.2+esm1)
Available with Ubuntu Pro |
| eoan |
Ignored
(end of life)
|
|
| focal |
Not vulnerable
(0.28.4+dfsg.1-2)
|
|
| groovy |
Ignored
(end of life)
|
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Not vulnerable
(1.1.0+dfsg.1-4.1build1)
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Not vulnerable
|
|
| mantic |
Not vulnerable
|
|
| trusty |
Needed
|
|
| upstream |
Released
(0.28.4,0.99.0)
|
|
| xenial |
Released
(0.24.1-2ubuntu0.2+esm2)
Available with Ubuntu Pro |
|
|
Patches: upstream: https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01 upstream: https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |