{"id":"CVE-2017-5338","aliases":["EUVD-2017-14443","SUSE-SU-2017:0433-1","UBUNTU-CVE-2017-5338","openSUSE-SU-2017:0405-1"],"status":"rejected","title":"Security update for libgit2","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-02-06T12:58:42Z","modified":"2026-02-04T03:25:29Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.6-10.1"}]}],"bundled":5}],"references":[{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170433-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019036","tags":["report"]},{"url":"https://bugzilla.suse.com/1019037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5339","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5338","tags":["report"]},{"url":"https://github.com/libgit2/libgit2/commit/98d66240ecb7765e191da19b535c75c92ccc90fe","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5338","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-5338","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2017-04-11T16:00:00Z","modified":"2017-04-11T15:57:02Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14443","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"published","published":"2017-04-11T16:00:00Z","modified":"2017-04-11T15:57:02Z","updated_at":"2026-11-03T04:08:13.115376Z"}],"nvd":[{"id":"CVE-2017-5338","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2017-04-11T16:59:00.267Z","modified":"2023-11-07T02:49:23.747Z","updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"openSUSE-SU-2017:0405-1","title":"Security update for libgit2","description":"\nThis update for libgit2 to version 0.24.6 fixes the following issues:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n","status":"published","published":"2017-02-06T12:58:42Z","modified":"2026-02-04T03:25:29.248978Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"SUSE-SU-2017:0433-1","title":"Security update for libgit2","description":"\nThis update for libgit2 fixes the several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n","status":"published","published":"2017-02-09T10:17:43Z","modified":"2026-02-04T02:18:28.648866Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"UBUNTU-CVE-2017-5338","description":"** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2017-04-11T16:59:00Z","modified":"2025-07-08T14:32:17.488055Z","updated_at":"2026-11-02T15:54:15.388065Z"}]}}