CVEvulnerability
CVE-2020-12279
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-04-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-706
Description
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
Affected configurations
• libgit2 libgit2 (< 0.28.4)
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-706 Use of Incorrectly-Resolved Name or Reference weakness
References
- https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4 Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4 Release Notes, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0 Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html lists.debian.org
- https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4 Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.28.4 Release Notes, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.99.0 Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html lists.debian.org