CVE-2020-12279: Critical severity centos libgcc vulnerability
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-12279?
CVE-2020-12279 is a vulnerability discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0 that mishandles equivalent filenames that exist because of NTFS short names, potentially allowing remote code execution when cloning a repository.
What is the severity of CVE-2020-12279?
The severity of CVE-2020-12279 is critical, with a severity score of 9.8.
How does CVE-2020-12279 affect Libgit2?
CVE-2020-12279 affects Libgit2 versions before 0.28.4 and 0.9x before 0.99.0 by mishandling equivalent filenames due to NTFS short names, which could lead to remote code execution during repository cloning.
How can I fix CVE-2020-12279?
To fix CVE-2020-12279, update Libgit2 to version 0.28.4 or later.
Are there any references for CVE-2020-12279?
Yes, here are some references for CVE-2020-12279: - [GitHub Security Advisory](https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v) - [Libgit2 Commit](https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4) - [Libgit2 Releases](https://github.com/libgit2/libgit2/releases/tag/v0.28.4)