PT-2017-7755 · Libgit2+2 · Libgit2+2

Andreas Stieger · Published 2017-01-12 · Updated 2024-06-15 · CVE-2016-10130

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 0.24.6 libgit2 versions 0.25.x prior to 0.25.1

Description The issue concerns the http connect function in transports/http.c, which might allow man-in-the-middle attackers to spoof servers. This is due to the clobbering of the error variable, potentially leading to security issues.

Recommendations For libgit2 versions prior to 0.24.6, update to version 0.24.6 or later. For libgit2 versions 0.25.x prior to 0.25.1, update to version 0.25.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2017-1036

CVE-2016-10130

OPENSUSE-SU-2017:0405-1

OPENSUSE-SU-2024:10943-1

SUSE-SU-2017:0433-1

Affected Products

Alt Linux

Suse

Libgit2

References · 47

• https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22 · Patch
• https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211 · Patch
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10130 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10130 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0433-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10130 · Security Note
• http://openwall.com/lists/oss-security/2017/01/10/5 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10129 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10130 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10128 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:0405-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10130 · Vendor Advisory