libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa - Patch | |
| References | () https://github.com/libgit2/libgit2/releases/tag/v1.6.5 - Release Notes | |
| References | () https://github.com/libgit2/libgit2/releases/tag/v1.7.2 - Release Notes | |
| References | () https://github.com/libgit2/libgit2/security/advisories/GHSA-54mf-x2rh-hq9v - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4M3P7WIEPXNRLBINQRJFXUSTNKBCHYC7/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7CNDW3PF6NHO7OXNM5GN6WSSGAMA7MZE/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S635BGHHZUMRPI7QOXOJ45QHDD5FFZ3S/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6MXOX7I43OWNN7R6M54XLG6U5RXY244/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGNHOEE2RBLH7KCJUPUNYG4CDTW4HTBT/ - |
22 Feb 2024, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Feb 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Feb 2024, 14:31
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Libgit2 libgit2
Libgit2 |
|
| References | () https://github.com/libgit2/libgit2/releases/tag/v1.6.5 - Release Notes | |
| References | () https://github.com/libgit2/libgit2/releases/tag/v1.7.2 - Release Notes | |
| References | () https://github.com/libgit2/libgit2/security/advisories/GHSA-54mf-x2rh-hq9v - Third Party Advisory | |
| References | () https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* |
06 Feb 2024, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-06 22:16
Updated : 2024-11-21 08:59
NVD link : CVE-2024-24575
Mitre link : CVE-2024-24575
CVE.ORG link : CVE-2024-24575
JSON object : View
Products Affected
libgit2
- libgit2
CWE
CWE-400
Uncontrolled Resource Consumption