It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-541 advisory.

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid     API, allowing to build Git functionality into your application. Using well-crafted inputs to     `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of     Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop     to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to     force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the     extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not     affected. Users should upgrade to version 1.6.5 or 1.7.2. (CVE-2024-24575)

  - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid     API, allowing to build Git functionality into your application. Using well-crafted inputs to     `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is     an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be     freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to     controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary     code execution. This issue has been patched in version 1.6.5 and 1.7.2. (CVE-2024-24577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2024-541)

critical Nessus Plugin ID 191595

Version 1.0