CVE-2020-12279
Fixed in a distro release EPSS 5%
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
Products: libgit2, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | libgit2 | 0.27.7+dfsg.1-0.2+deb10u1 |
| Debian 12 | libgit2 | 0.28.4+dfsg.1-2 |
| Debian 13 | libgit2 | 0.28.4+dfsg.1-2 |
| Debian 14 | libgit2 | 0.28.4+dfsg.1-2 |
| Debian 9 | libgit2 | 0.25.1+really0.24.6-1+deb9u1 |
| Ubuntu 20.04 LTS | libgit2 | 0.28.4+dfsg.1-2ubuntu0.1 |
| Ubuntu 22.04 LTS | libgit2 | 1.1.0+dfsg.1-4.1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | libgit2 | no fix |
| Ubuntu Pro 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2+esm2 |
| Ubuntu Pro 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2+esm1 |