libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
Résumé
libgit2 is vulnerable to a denial of service attack in git_revparse_single
Description d'origine
La description telle que publiée par la source (souvent en anglais).
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git_revparse_single can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in src/libgit2/revparse.c uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-24575 libgit2 Corrigé dans: 1.5.1+ds-1+deb12u1
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org