{"id":"CVE-2020-12278","aliases":["DEBIAN-CVE-2020-12278","DLA-2936-1","DLA-3340-1","EUVD-2020-4591","GHSA-5wph-8frv-58vj","GHSA-w32v-c4gg-xc8p","JLSEC-2025-182","OESA-2021-1282","UBUNTU-CVE-2020-12278","USN-6678-1"],"status":"published","title":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles...","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.05238,"percentile":0.92639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-706"],"published":"2020-04-27T00:00:00Z","modified":"2026-10-26T12:01:25Z","fixes":[{"ecosystem":"Debian:12","package":"libgit2","fixed_in":["0.28.4+dfsg.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgit2","fixed_in":["0.28.4+dfsg.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgit2","fixed_in":["0.28.4+dfsg.1-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibGit2_jll","fixed_in":["0.28.5+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","fixed_in":["0.24.1-2ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","fixed_in":["0.26.0+dfsg.1-1.1ubuntu0.2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1+really0.24.6-1+deb9u1"}]}],"versions":["0.25.1+really0.24.6-1"],"bundled":7},{"source":"osv","ecosystem":"Debian:10","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.7+dfsg.1-0.2+deb10u1"}]}],"versions":["0.27.7+dfsg.1-0.2"],"bundled":3},{"source":"osv","ecosystem":"Julia","package":"LibGit2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.28.5+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.8-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.8-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.19.0-2ubuntu0.4","0.19.0-2ubuntu0.4+esm1","0.19.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-2ubuntu0.2+esm2"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1"}]}],"versions":["0.25.1+really0.24.6-1","0.26.0+dfsg.1-1.1","0.26.0+dfsg.1-1.1build1","0.26.0+dfsg.1-1.1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-2ubuntu0.2+esm2"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1"}]}],"versions":["0.25.1+really0.24.6-1","0.26.0+dfsg.1-1.1","0.26.0+dfsg.1-1.1build1","0.26.0+dfsg.1-1.1ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2ubuntu0.1"}]}],"versions":["0.27.7+dfsg.1-0.2build1","0.28.3+dfsg.1-1","0.28.3+dfsg.1-1ubuntu1","0.28.4+dfsg.1-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+dfsg.1-4.1ubuntu0.1"}]}],"versions":["1.1.0+dfsg.1-4","1.1.0+dfsg.1-4.1","1.1.0+dfsg.1-4.1build1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libgit2","product":"libgit2"}],"references":[{"url":"https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/libgit2/libgit2/releases/tag/v0.99.0","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/libgit2/libgit2/releases/tag/v0.28.4","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12278","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w32v-c4gg-xc8p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12278","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12279","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-12278","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6678-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24577","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-12278","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T00:00:00Z","modified":"2024-08-04T11:48:58.55Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-4591","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T00:00:00Z","modified":"2024-08-04T11:48:58Z","updated_at":"2026-11-03T03:07:40.81889Z"}],"ghsa":[{"id":"GHSA-w32v-c4gg-xc8p","title":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles...","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2022-05-24T17:16:36Z","modified":"2023-02-24T00:30:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-706"],"updated_at":"2026-11-02T14:54:13.537745Z"}],"nvd":[{"id":"CVE-2020-12278","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T17:15:13.407Z","modified":"2026-06-17T02:51:33.39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:05:59.718774Z"}],"osv":[{"id":"CVE-2020-12278","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T17:15:13.407Z","modified":"2026-10-20T13:43:59.976259912Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12278","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T17:15:13.407Z","modified":"2026-10-26T12:01:25.165356967Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"JLSEC-2025-182","title":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2025-10-21T19:17:09.363Z","modified":"2026-07-18T00:00:53.966215333Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1282","title":"libgit2 security update","description":"libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.(CVE-2020-12278)\r\n\r\nAn issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.(CVE-2020-12279)","status":"published","published":"2021-07-27T11:04:31Z","modified":"2026-08-18T01:15:51.801378596Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-12278","description":"An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.","status":"published","published":"2020-04-27T17:15:00Z","modified":"2026-08-13T02:54:57.88940496Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2936-1","title":"libgit2 - security update","status":"published","published":"2022-03-07T00:00:00Z","modified":"2026-03-09T01:23:32.580319Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3340-1","title":"libgit2 - security update","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-03-09T01:21:33.663191Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-6678-1","title":"libgit2 vulnerabilities","description":"It was discovered that libgit2 mishandled equivalent filenames on NTFS\npartitions. If a user or automated system were tricked into cloning a\nspecially crafted repository, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)\n\nIt was discovered that libgit2 did not perform certificate checking by\ndefault. An attacker could possibly use this issue to perform a\nmachine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)\n\nIt was discovered that libgit2 could be made to run into an infinite loop.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 23.10. (CVE-2024-24575)\n\nIt was discovered that libgit2 did not properly manage memory. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-24577)\n","status":"published","published":"2024-03-05T18:46:35Z","modified":"2026-06-25T13:32:28.756070378Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}