CVE-2020-12279
CRITICALlibgit2 < 0.28.4 and 0.9x < 0.99.0 - Remote Code Execution via NTFS Short Name Mishandling
Title source: llmDescription
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
References (6)
Core 6
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
Patch, Third Party Advisory
https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v
Patch, Third Party Advisory
https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4
Release Notes, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.28.4
Release Notes, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.99.0
Scores
CVSS v3
9.8
EPSS
0.0509
EPSS Percentile
91.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-706
Status
published
Products (2)
debian/debian_linux
9.0
libgit2/libgit2
< 0.28.4
Published
Apr 27, 2020
Tracked Since
Feb 18, 2026