OESA-2021-1282

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1282
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2021-1282.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2021-1282
Upstream
Published
2021-07-27T11:03:04Z
Modified
2025-08-12T05:05:00.934308Z
Summary
libgit2 security update
Details

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.

Security Fix(es):

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.(CVE-2020-12278)

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.(CVE-2020-12279)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.27.8-5.oe1

Ecosystem specific 

{
    "x86_64": [
        "libgit2-devel-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-debugsource-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-debuginfo-0.27.8-5.oe1.x86_64.rpm"
    ],
    "src": [
        "libgit2-0.27.8-5.oe1.src.rpm"
    ],
    "aarch64": [
        "libgit2-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-debuginfo-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-debugsource-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-devel-0.27.8-5.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP2 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-20.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.27.8-5.oe1

Ecosystem specific 

{
    "x86_64": [
        "libgit2-debuginfo-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-debugsource-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-0.27.8-5.oe1.x86_64.rpm",
        "libgit2-devel-0.27.8-5.oe1.x86_64.rpm"
    ],
    "src": [
        "libgit2-0.27.8-5.oe1.src.rpm"
    ],
    "aarch64": [
        "libgit2-debugsource-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-devel-0.27.8-5.oe1.aarch64.rpm",
        "libgit2-debuginfo-0.27.8-5.oe1.aarch64.rpm"
    ]
}