Headline
Ubuntu Security Notice USN-6678-1
Ubuntu Security Notice 6678-1 - It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that libgit2 did not perform certificate checking by default. An attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
==========================================================================
Ubuntu Security Notice USN-6678-1
March 05, 2024
libgit2 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in libgit2.
Software Description:
- libgit2: Portable C implementation of the Git core methods library
Details:
It was discovered that libgit2 mishandled equivalent filenames on NTFS
partitions. If a user or automated system were tricked into cloning a
specially crafted repository, an attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)
It was discovered that libgit2 did not perform certificate checking by
default. An attacker could possibly use this issue to perform a
machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)
It was discovered that libgit2 could be made to run into an infinite loop.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 23.10. (CVE-2024-24575)
It was discovered that libgit2 did not properly manage memory. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2024-24577)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libgit2-1.5 1.5.1+ds-1ubuntu1.1
Ubuntu 22.04 LTS:
libgit2-1.1 1.1.0+dfsg.1-4.1ubuntu0.1
Ubuntu 20.04 LTS:
libgit2-28 0.28.4+dfsg.1-2ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libgit2-26 0.26.0+dfsg.1-1.1ubuntu0.2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libgit2-24 0.24.1-2ubuntu0.2+esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6678-1
CVE-2020-12278, CVE-2020-12279, CVE-2023-22742, CVE-2024-24575,
CVE-2024-24577
Package Information:
https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1
https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1
https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1
Related news
Debian Linux Security Advisory 5619-1 - Two vulnerabilities were discovered in libgit2, a low-level Git library, which may result in denial of service or potentially the execution of arbitrary code.
Debian Linux Security Advisory 5619-1 - Two vulnerabilities were discovered in libgit2, a low-level Git library, which may result in denial of service or potentially the execution of arbitrary code.
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.