Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8098: libgit2: Denial of Service via Malicious Repository File

CVE-2018-8098 · published 8 years ago

Summary

An attacker can create a malicious repository file that causes libgit2 to crash. This is a concern for developers and organizations that use libgit2 to manage and interact with Git repositories. To protect against this, update to libgit2 version 0.26.2 or later.

What to do

Update libgit2 libgit2 to version 0.26.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:18.04:LTS	canonical	libgit2	All versions
–	libgit2	libgit2	< 0.26.2 `cpe:2.3:a:libgit2:libgit2::::::::`
–	debian	debian_linux	9.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`

Original advisory text

Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) v...

References

https://ubuntu.com/security/CVE-2018-8098 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-8098 Third Party Advisory
https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900... Patch Third Party Advisory
https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bca... Patch Third Party Advisory
https://libgit2.github.com/security/ Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html Mailing List Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published14 Mar 2018

Updated4 Nov 2026

First seen13 Aug 2026

Sources

UBUNTU-CVE-2018-8098 · OSV

CVE-2018-8098 · NVD

Track software like this

Free during beta