Skip to content
OpenAdvisories
Unscored CVE-2020-12279 EUVD-2020-4592GHSA-jq74-8pv3-p93c

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of N…

Published Apr 27, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: libgit2 Package: libgit2 Ecosystem: Debian Ecosystem: Ubuntu

Description

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libgit2 0.28.4+dfsg.1-2 —
Debian 13 libgit2 0.28.4+dfsg.1-2 —
Debian 12 libgit2 0.28.4+dfsg.1-2 —
Debian 10 libgit2 0.27.7+dfsg.1-0.2+deb10u1 DLA-3340-1
Debian 9 libgit2 0.25.1+really0.24.6-1+deb9u1 DLA-2936-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS libgit2 1.1.0+dfsg.1-4.1ubuntu0.1 USN-6678-1
Ubuntu 20.04 LTS libgit2 0.28.4+dfsg.1-2ubuntu0.1 USN-6678-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS libgit2 0.26.0+dfsg.1-1.1ubuntu0.2+esm1 USN-6678-1
Ubuntu Pro 16.04 LTS libgit2 0.24.1-2ubuntu0.2+esm2 USN-6678-1
Ubuntu Pro 14.04 LTS libgit2 No fix yet —

Advisories 3

References