An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6678-1 advisory.

    It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated     system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2020-12278, CVE-2020-12279)

    It was discovered that libgit2 did not perform certificate checking by default. An attacker could possibly     use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)

    It was discovered that libgit2 could be made to run into an infinite loop. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-24575)

    It was discovered that libgit2 did not properly manage memory. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. (CVE-2024-24577)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3340 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3340-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     February 23, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libgit2     Version        : 0.27.7+dfsg.1-0.2+deb10u1     CVE ID         : CVE-2020-12278 CVE-2020-12279 CVE-2023-22742     Debian Bug     : 1029368

    A vulnerability have been found in libgit2, a cross-platform, linkable     library implementation of Git, which may result in remote code execution     when cloning a repository on a NTFS-like filesystem or man-in-the-middle     attacks due to improper verification of cryptographic Signature.

    CVE-2020-12278

        An issue was discovered in libgit2 before 0.28.4 and 0.9x before         0.99.0.  path.c mishandles equivalent filenames that exist because of         NTFS Alternate Data Streams. This may allow remote code execution when         cloning a repository.

    CVE-2020-12279

        An issue was discovered in libgit2 before 0.28.4 and 0.9x before         0.99.0.  checkout.c mishandles equivalent filenames that exist because         of NTFS short names. This may allow remote code execution when cloning a         repository

    CVE-2023-22742

        libgit2 is a cross-platform, linkable library implementation of Git.
        When using an SSH remote with the optional libssh2 backend, libgit2 does         not perform certificate checking by default. Prior versions of libgit2         require the caller to set the `certificate_check` field of libgit2's         `git_remote_callbacks` structure - if a certificate check callback is         not set, libgit2 does not perform any certificate checking. This means         that by default - without configuring a certificate check callback,         clients will not perform validation on the server SSH keys and may be         subject to a man-in-the-middle attack.

    For Debian 10 buster, these problems have been fixed in version     0.27.7+dfsg.1-0.2+deb10u1.

    We recommend that you upgrade your libgit2 packages.

    For the detailed security status of libgit2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libgit2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2936 advisory.

    Multiple vulnerabilities were found in libgit2, a low-level Git library, and are as follows: CVE-2018-8098     Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in     libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted     repository index file. CVE-2018-8099 Incorrect returning of an error code in the index.c:read_entry()     function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of     service via a crafted repository index file. CVE-2018-10887 It has been discovered that an unexpected sign     extension in git_delta_apply function in delta-apply.c file may lead to an integer overflow which in turn     leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to     leak memory addresses or cause a Denial of Service. CVE-2018-10888 A missing check in git_delta_apply     function in delta-apply.c file, may lead to an out-of-bound read while reading a binary delta file. An     attacker may use this flaw to cause a Denial of Service. CVE-2018-15501 In ng_pkt in     transports/smart_pkt.c in libgit2, a remote attacker can send a crafted smart-protocol ng packet that     lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS. CVE-2020-12278 path.c mishandles     equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code     execution when cloning a repository. This issue is similar to CVE-2019-1352. CVE-2020-12279 checkout.c     mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code     execution when cloning a repository. This issue is similar to CVE-2019-1353. For Debian 9 stretch, these     problems have been fixed in version 0.25.1+really0.24.6-1+deb9u1. We recommend that you upgrade your     libgit2 packages. For the detailed security status of libgit2 please refer to its security tracker page     at: https://security-tracker.debian.org/tracker/libgit2 Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libgit2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libgit2 before 0.28.4 and     0.9x before 0.99.0. path.c mishandles equivalent     filenames that exist because of NTFS Alternate Data     Streams. This may allow remote code execution when     cloning a repository. This issue is similar to     CVE-2019-1352.(CVE-2020-12278)

  - An issue was discovered in libgit2 before 0.28.4 and     0.9x before 0.99.0. checkout.c mishandles equivalent     filenames that exist because of NTFS short names. This     may allow remote code execution when cloning a     repository. This issue is similar to     CVE-2019-1353.(CVE-2020-12279)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
191559	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : libgit2 vulnerabilities (USN-6678-1)	Nessus	Ubuntu Local Security Checks	critical
171871	Debian dla-3340 : libgit2-27 - security update	Nessus	Debian Local Security Checks	critical
159090	Debian DLA-2936-1 : libgit2 - LTS security update	Nessus	Debian Local Security Checks	critical
139964	EulerOS 2.0 SP8 : libgit2 (EulerOS-SA-2020-1861)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2020-12278

critical

Tenable Plugins

critical

critical

critical

critical