PT-2017-7755 · Libgit2+2 · Libgit2+2

Andreas Stieger · Publicado 2017-01-12 · Atualizado 2024-06-15 · CVE-2016-10130

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 0.24.6 libgit2 versions 0.25.x prior to 0.25.1

Description The issue concerns the http connect function in transports/http.c, which might allow man-in-the-middle attackers to spoof servers. This is due to the clobbering of the error variable, potentially leading to security issues.

Recommendations For libgit2 versions prior to 0.24.6, update to version 0.24.6 or later. For libgit2 versions 0.25.x prior to 0.25.1, update to version 0.25.1 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2017-1036

CVE-2016-10130

OPENSUSE-SU-2017:0405-1

OPENSUSE-SU-2024:10943-1

SUSE-SU-2017:0433-1

Produtos afetados

Alt Linux

Suse

Libgit2

Referências · 47

• https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22 · Correção
• https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211 · Correção
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-1349 · Nota
• https://suse.com/security/cve/CVE-2016-10130 · Nota
• https://security.alpinelinux.org/vuln/CVE-2016-10130 · Nota
• https://suse.com/security/cve/CVE-2005-4900 · Nota
• https://suse.com/security/cve/CVE-2017-5339 · Nota
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10130 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-1348 · Nota
• https://suse.com/security/cve/CVE-2017-5338 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10130 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-10129 · Nota
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html · Aviso do Fabricante