CVE-2020-12279 - CVE House
Back to Database
Status published Critical CVE-2020-12279

An issue was discovered in libgit2 before 0.28.4 and 0.9x...

Vulnerability Description

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12279

Credits & Attribution

No credits recorded in the NVD database.

References

More from libgit2

View All →
CVE-2024-24577
libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
High 8.6
CVE-2024-24575
libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
High 7.5
CVE-2023-22742
libgit2 fails to verify SSH keys by default
Medium 5.3
CVE-2020-12278
An issue was discovered in libgit2 before 0.28.4 and 0.9x...
Critical 9.8
CVE-2018-8099
Incorrect returning of an error code in the index.c:read_entry() function...
Medium 6.5

Affected Vendor

Affected Software

libgit2, debian linux
Vulnerable Versions:
0, 9.0

Timeline

Official Publish: April 27th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.