OESA-2024-1188

Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1188
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2024-1188.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2024-1188
Upstream
Published
2024-02-23T11:07:01Z
Modified
2025-08-12T05:25:16.014708Z
Summary
libgit2 security update
Details

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.

Security Fix(es):

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git_index_add can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the has_dir_name function in src/libgit2/index.c, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.(CVE-2024-24577)

Database specific
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.27.8-8.oe1

Ecosystem specific

{
    "src": [
        "libgit2-0.27.8-8.oe1.src.rpm"
    ],
    "aarch64": [
        "libgit2-debuginfo-0.27.8-8.oe1.aarch64.rpm",
        "libgit2-0.27.8-8.oe1.aarch64.rpm",
        "libgit2-devel-0.27.8-8.oe1.aarch64.rpm",
        "libgit2-debugsource-0.27.8-8.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-devel-0.27.8-8.oe1.x86_64.rpm",
        "libgit2-debugsource-0.27.8-8.oe1.x86_64.rpm",
        "libgit2-0.27.8-8.oe1.x86_64.rpm",
        "libgit2-debuginfo-0.27.8-8.oe1.x86_64.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.27.8-8.oe2003sp4

Ecosystem specific

{
    "src": [
        "libgit2-0.27.8-8.oe2003sp4.src.rpm"
    ],
    "aarch64": [
        "libgit2-debugsource-0.27.8-8.oe2003sp4.aarch64.rpm",
        "libgit2-0.27.8-8.oe2003sp4.aarch64.rpm",
        "libgit2-debuginfo-0.27.8-8.oe2003sp4.aarch64.rpm",
        "libgit2-devel-0.27.8-8.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-debuginfo-0.27.8-8.oe2003sp4.x86_64.rpm",
        "libgit2-debugsource-0.27.8-8.oe2003sp4.x86_64.rpm",
        "libgit2-0.27.8-8.oe2003sp4.x86_64.rpm",
        "libgit2-devel-0.27.8-8.oe2003sp4.x86_64.rpm"
    ]
}

openEuler:22.03-LTS / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-3.oe2203sp3

Ecosystem specific

{
    "src": [
        "libgit2-0.27.8-8.oe2203.src.rpm",
        "libgit2-1.3.2-3.oe2203sp1.src.rpm",
        "libgit2-1.3.2-3.oe2203sp2.src.rpm",
        "libgit2-1.3.2-3.oe2203sp3.src.rpm"
    ],
    "aarch64": [
        "libgit2-debugsource-0.27.8-8.oe2203.aarch64.rpm",
        "libgit2-devel-0.27.8-8.oe2203.aarch64.rpm",
        "libgit2-debuginfo-0.27.8-8.oe2203.aarch64.rpm",
        "libgit2-0.27.8-8.oe2203.aarch64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-debugsource-0.27.8-8.oe2203.x86_64.rpm",
        "libgit2-devel-0.27.8-8.oe2203.x86_64.rpm",
        "libgit2-debuginfo-0.27.8-8.oe2203.x86_64.rpm",
        "libgit2-0.27.8-8.oe2203.x86_64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp3.x86_64.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-3.oe2203sp1

Ecosystem specific

{
    "src": [
        "libgit2-1.3.2-3.oe2203sp1.src.rpm"
    ],
    "aarch64": [
        "libgit2-debugsource-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp1.aarch64.rpm",
        "libgit2-1.3.2-3.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-devel-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-1.3.2-3.oe2203sp1.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp1.x86_64.rpm"
    ]
}

openEuler:22.03-LTS-SP2 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-3.oe2203sp2

Ecosystem specific

{
    "src": [
        "libgit2-1.3.2-3.oe2203sp2.src.rpm"
    ],
    "aarch64": [
        "libgit2-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp2.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp2.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-debugsource-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-1.3.2-3.oe2203sp2.x86_64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp2.x86_64.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / libgit2

Package

Name
libgit2
Purl
pkg:rpm/openEuler/libgit2&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-3.oe2203sp3

Ecosystem specific

{
    "src": [
        "libgit2-1.3.2-3.oe2203sp3.src.rpm"
    ],
    "aarch64": [
        "libgit2-debuginfo-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp3.aarch64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "libgit2-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-devel-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-debuginfo-1.3.2-3.oe2203sp3.x86_64.rpm",
        "libgit2-debugsource-1.3.2-3.oe2203sp3.x86_64.rpm"
    ]
}