CVE-2016-10130
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1...
CVE-2016-10130 is a medium vulnerability (CVSS 5.9) in Libgit2 Project Libgit2, published February 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in libgit2 0.25.1-r0.
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
CVE-2016-10130- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
CVE-2016-10130- Updated
- 2026-11-02
EUVDEUVD-2016-1320 No score
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
EUVD-2016-1320- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fhf3-77x2-3mpp
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1...
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
GHSA-fhf3-77x2-3mpp- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-10130
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
ALPINE-CVE-2016-10130- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
CVE-2016-10130- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2016-10130
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
DEBIAN-CVE-2016-10130- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10130
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- Record
UBUNTU-CVE-2016-10130- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0405-1 No score
Security update for libgit2
This update for libgit2 to version 0.24.6 fixes the following issues:
- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
- Record
openSUSE-SU-2017:0405-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10943-1 No score
libgit2-1_1-1.1.1-1.2 on GA media
These are all security issues fixed in the libgit2-1_1-1.1.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10943-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0433-1 No score
Security update for libgit2
This update for libgit2 fixes the several issues.
These security issues were fixed:
- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
- Record
SUSE-SU-2017:0433-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgit2Alpine:v3.10 |
before 0.25.1-r0 | 0.25.1-r0 |
libgit2Alpine:v3.11 |
before 0.25.1-r0 | 0.25.1-r0 |
libgit2Alpine:v3.4 |
before 0.24.6-r0 | 0.24.6-r0 |
libgit2Alpine:v3.5 |
before 0.24.6-r0 | 0.24.6-r0 |
libgit2Alpine:v3.6 |
before 0.25.1-r0 | 0.25.1-r0 |
libgit2Alpine:v3.7 |
before 0.25.1-r0 | 0.25.1-r0 |
libgit2Alpine:v3.8 |
before 0.25.1-r0 | 0.25.1-r0 |
libgit2Alpine:v3.9 |
before 0.25.1-r0 | 0.25.1-r0 |
cargoDebian:12 |
before 0.17.0-1 | 0.17.0-1 |
libgit2Debian:12 |
before 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgit2Debian:13 |
before 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
libgit2Debian:14 |
before 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
libgit2SUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.24.1-6.1 | 0.24.1-6.1 |
libgit2Ubuntu:Pro:16.04:LTS |
before 0.24.1-2ubuntu0.2+esm3, plus listed versions 0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm10.24.1-2ubuntu0.2+esm2 |
0.24.1-2ubuntu0.2+esm3 |
libgit2SUSE:Package Hub 12 SP1 |
before 0.24.6-10.1 | 0.24.6-10.1 |
libgit2openSUSE:Tumbleweed |
before 1.1.1-1.2 | 1.1.1-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
libgit2.github.com/security
openwall.com/lists/oss-security/2017/01/10/5
securityfocus.com/bid/95359
github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22
lists.opensuse.org/opensuse-updates/2017-02/msg00030.html
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-10130
security.alpinelinux.org/vuln/CVE-2016-10130
security-tracker.debian.org/tracker/CVE-2016-10130
suse.com/support/update/announcement/2017/suse-su-20170433-1
bugzilla.suse.com/1019036
ubuntu.com/security/CVE-2016-10130
cve.org/CVERecord?id=CVE-2016-10130