Every CVE Search/ Get API key

CVE-2020-12279

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles...

9.8 CriticalFix available

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.07%Up 2.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
CVE-2020-12279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-706
Updated
2026-11-02
CVE List No score

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
CVE-2020-12279
Updated
2026-11-02
EUVDEUVD-2020-4592 No score

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
EUVD-2020-4592
Updated
2026-11-03
GitHub AdvisoriesGHSA-jq74-8pv3-p93c 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles...

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
GHSA-jq74-8pv3-p93c
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-706
Updated
2026-11-02
OSV 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
CVE-2020-12279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-12279 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
DEBIAN-CVE-2020-12279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVJLSEC-2025-183 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
JLSEC-2025-183
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVOESA-2021-1282 8.1

libgit2 security update

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.

Security Fix(es):

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.(CVE-2020-12278)

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.(CVE-2020-12279)

Record
OESA-2021-1282
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12279 9.8

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Record
UBUNTU-CVE-2020-12279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-6678-1 No score

libgit2 vulnerabilities

It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)

It was discovered that libgit2 did not perform certificate checking by default. An attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)

It was discovered that libgit2 could be made to run into an infinite loop. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-24575)

It was discovered that libgit2 did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-24577)

Record
USN-6678-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libgit2
Debian:12
 before 0.28.4+dfsg.1-2
0.28.4+dfsg.1-2
libgit2
Debian:13
 before 0.28.4+dfsg.1-2
0.28.4+dfsg.1-2
libgit2
Debian:14
 before 0.28.4+dfsg.1-2
0.28.4+dfsg.1-2
libgit2
Debian:9
From an advisory covering 7 CVEs
 before 0.25.1+really0.24.6-1+deb9u1, plus listed versions
0.25.1+really0.24.6-1
0.25.1+really0.24.6-1+deb9u1
libgit2
Debian:10
From an advisory covering 3 CVEs
 before 0.27.7+dfsg.1-0.2+deb10u1, plus listed versions
0.27.7+dfsg.1-0.2
0.27.7+dfsg.1-0.2+deb10u1
LibGit2_jll
Julia
 before 0.28.5+0
0.28.5+0
libgit2
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 0.27.8-5.oe1
0.27.8-5.oe1
libgit2
openEuler:20.03-LTS-SP2
From an advisory covering 2 CVEs
 before 0.27.8-5.oe1
0.27.8-5.oe1
libgit2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.19.0-20.19.0-2ubuntu0.40.19.0-2ubuntu0.4+esm10.19.0-2ubuntu0.4+esm2
 None known
libgit2
Ubuntu:Pro:16.04:LTS
 before 0.24.1-2ubuntu0.2+esm2, plus listed versions
0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm1
0.24.1-2ubuntu0.2+esm2
Show 5 moreShow less
Affected packages
PackageAffectedFixed
libgit2
Ubuntu:Pro:18.04:LTS
 before 0.26.0+dfsg.1-1.1ubuntu0.2+esm1, plus listed versions
0.25.1+really0.24.6-10.26.0+dfsg.1-1.10.26.0+dfsg.1-1.1build10.26.0+dfsg.1-1.1ubuntu0.2
0.26.0+dfsg.1-1.1ubuntu0.2+esm1
libgit2
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 0.24.1-2ubuntu0.2+esm2, plus listed versions
0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm1
0.24.1-2ubuntu0.2+esm2
libgit2
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 0.26.0+dfsg.1-1.1ubuntu0.2+esm1, plus listed versions
0.25.1+really0.24.6-10.26.0+dfsg.1-1.10.26.0+dfsg.1-1.1build10.26.0+dfsg.1-1.1ubuntu0.2
0.26.0+dfsg.1-1.1ubuntu0.2+esm1
libgit2
Ubuntu:20.04:LTS
From an advisory covering 4 CVEs
 before 0.28.4+dfsg.1-2ubuntu0.1, plus listed versions
0.27.7+dfsg.1-0.2build10.28.3+dfsg.1-10.28.3+dfsg.1-1ubuntu10.28.4+dfsg.1-2
0.28.4+dfsg.1-2ubuntu0.1
libgit2
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 1.1.0+dfsg.1-4.1ubuntu0.1, plus listed versions
1.1.0+dfsg.1-41.1.0+dfsg.1-4.11.1.0+dfsg.1-4.1build1
1.1.0+dfsg.1-4.1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12279 is a critical vulnerability (CVSS 9.8) in Libgit2, published April 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.07%, the 92nd percentile. Fixed in libgit2 0.28.4+dfsg.1-2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open