Vulnerability Description
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libgit2 | Libgit2 | < 0.28.4 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733vPatchThird Party Advisory
- https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751PatchThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release NotesThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
- https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733vPatchThird Party Advisory
- https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751PatchThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release NotesThird Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
FAQ
What is CVE-2020-12279?
CVE-2020-12279 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cl...
How severe is CVE-2020-12279?
CVE-2020-12279 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-12279?
Check the references section above for vendor advisories and patch information. Affected products include: Libgit2 Libgit2, Debian Debian Linux.