Vulnerability Description
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libgit2 | Libgit2 | < 0.28.4 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vjThird Party Advisory
- https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776edPatchThird Party Advisory
- https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300PatchThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release NotesThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
- https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vjThird Party Advisory
- https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776edPatchThird Party Advisory
- https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300PatchThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release NotesThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
FAQ
What is CVE-2020-12278?
CVE-2020-12278 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution ...
How severe is CVE-2020-12278?
CVE-2020-12278 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-12278?
Check the references section above for vendor advisories and patch information. Affected products include: Libgit2 Libgit2, Debian Debian Linux.