Skip to content
OpenAdvisories
High USN-6678-1 4 CVEs

libgit2 vulnerabilities

Published Mar 5, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libgit2 mishandled equivalent filenames on NTFS
partitions. If a user or automated system were tricked into cloning a
specially crafted repository, an attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)

It was discovered that libgit2 did not perform certificate checking by
default. An attacker could possibly use this issue to perform a
machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)

It was discovered that libgit2 could be made to run into an infinite loop.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 23.10. (CVE-2024-24575)

It was discovered that libgit2 did not properly manage memory. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2024-24577)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS libgit2 0.28.4+dfsg.1-2ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS libgit2 1.1.0+dfsg.1-4.1ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libgit2 0.24.1-2ubuntu0.2+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libgit2 0.26.0+dfsg.1-1.1ubuntu0.2+esm1

Vulnerabilities 4

  • High 8.6
    CVE-2024-24577

    libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be lev…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-22742

    libgit2 fails to verify SSH keys by default

    libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_che…

    libgit2 libgit2 rust libgit2 Debian Ubuntu Azure Linux Alpine crates.io
  • Unscored —
    CVE-2020-12278

    An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that ex…

    libgit2 libgit2 Debian Ubuntu
  • Unscored —
    CVE-2020-12279

    An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames tha…

    libgit2 libgit2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-12278
  • report
    https://ubuntu.com/security/CVE-2020-12279
  • report
    https://ubuntu.com/security/CVE-2023-22742
  • report
    https://ubuntu.com/security/CVE-2024-24575
  • report
    https://ubuntu.com/security/CVE-2024-24577