CVE-2020-12278
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles...
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
CVE-2020-12278- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-706
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
CVE-2020-12278- Updated
- 2026-11-02
EUVDEUVD-2020-4591 No score
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
EUVD-2020-4591- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w32v-c4gg-xc8p
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles...
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
GHSA-w32v-c4gg-xc8p- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-706
- Updated
- 2026-11-02
OSV
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
CVE-2020-12278- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-12278
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
DEBIAN-CVE-2020-12278- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVJLSEC-2025-182
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
JLSEC-2025-182- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVOESA-2021-1282
libgit2 security update
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.
Security Fix(es):
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.(CVE-2020-12278)
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.(CVE-2020-12279)
- Record
OESA-2021-1282- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-12278
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
- Record
UBUNTU-CVE-2020-12278- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6678-1 No score
libgit2 vulnerabilities
It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)
It was discovered that libgit2 did not perform certificate checking by default. An attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)
It was discovered that libgit2 could be made to run into an infinite loop. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-24575)
It was discovered that libgit2 did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-24577)
- Record
USN-6678-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgit2Debian:12 |
before 0.28.4+dfsg.1-2 | 0.28.4+dfsg.1-2 |
libgit2Debian:13 |
before 0.28.4+dfsg.1-2 | 0.28.4+dfsg.1-2 |
libgit2Debian:14 |
before 0.28.4+dfsg.1-2 | 0.28.4+dfsg.1-2 |
libgit2Debian:9 From an advisory covering 7 CVEs |
before 0.25.1+really0.24.6-1+deb9u1, plus listed versions 0.25.1+really0.24.6-1 |
0.25.1+really0.24.6-1+deb9u1 |
libgit2Debian:10 From an advisory covering 3 CVEs |
before 0.27.7+dfsg.1-0.2+deb10u1, plus listed versions 0.27.7+dfsg.1-0.2 |
0.27.7+dfsg.1-0.2+deb10u1 |
LibGit2_jllJulia |
before 0.28.5+0 | 0.28.5+0 |
libgit2openEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 0.27.8-5.oe1 | 0.27.8-5.oe1 |
libgit2openEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 0.27.8-5.oe1 | 0.27.8-5.oe1 |
libgit2Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.19.0-20.19.0-2ubuntu0.40.19.0-2ubuntu0.4+esm10.19.0-2ubuntu0.4+esm2 |
None known |
libgit2Ubuntu:Pro:16.04:LTS |
before 0.24.1-2ubuntu0.2+esm2, plus listed versions 0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm1 |
0.24.1-2ubuntu0.2+esm2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgit2Ubuntu:Pro:18.04:LTS |
before 0.26.0+dfsg.1-1.1ubuntu0.2+esm1, plus listed versions 0.25.1+really0.24.6-10.26.0+dfsg.1-1.10.26.0+dfsg.1-1.1build10.26.0+dfsg.1-1.1ubuntu0.2 |
0.26.0+dfsg.1-1.1ubuntu0.2+esm1 |
libgit2Ubuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 0.24.1-2ubuntu0.2+esm2, plus listed versions 0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm1 |
0.24.1-2ubuntu0.2+esm2 |
libgit2Ubuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 0.26.0+dfsg.1-1.1ubuntu0.2+esm1, plus listed versions 0.25.1+really0.24.6-10.26.0+dfsg.1-1.10.26.0+dfsg.1-1.1build10.26.0+dfsg.1-1.1ubuntu0.2 |
0.26.0+dfsg.1-1.1ubuntu0.2+esm1 |
libgit2Ubuntu:20.04:LTS From an advisory covering 4 CVEs |
before 0.28.4+dfsg.1-2ubuntu0.1, plus listed versions 0.27.7+dfsg.1-0.2build10.28.3+dfsg.1-10.28.3+dfsg.1-1ubuntu10.28.4+dfsg.1-2 |
0.28.4+dfsg.1-2ubuntu0.1 |
libgit2Ubuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1.1.0+dfsg.1-4.1ubuntu0.1, plus listed versions 1.1.0+dfsg.1-41.1.0+dfsg.1-4.11.1.0+dfsg.1-4.1build1 |
1.1.0+dfsg.1-4.1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12278 is a critical vulnerability (CVSS 9.8) in Libgit2, published April 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.24%, the 92nd percentile. Fixed in libgit2 0.28.4+dfsg.1-2.
References
github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj
lists.debian.org/debian-lts-announce/2022/03/msg00031.html
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-12278
security-tracker.debian.org/tracker/CVE-2020-12278
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1282
ubuntu.com/security/CVE-2020-12278
cve.org/CVERecord?id=CVE-2020-12278