{"id":"MGASA-2019-0391","summary":"Updated libgit2 packages fix security vulnerabilities","details":"libgit2 has been updated to version 0.28.4 to fix several security issues:\n\n* A carefully constructed commit object with a very large number\n  of parents may lead to potential out-of-bounds writes or\n  potential denial of service.\n\n* CVE-2019-1348: the fast-import stream command \"feature\n  export-marks=path\" allows writing to arbitrary file paths. As\n  libgit2 does not offer any interface for fast-import, it is not\n  susceptible to this vulnerability.\n\n* CVE-2019-1350: recursive clones may lead to arbitrary remote\n  code executing due to improper quoting of command line\n  arguments. As libgit2 uses libssh2, which does not require us\n  to perform command line parsing, it is not susceptible to this\n  vulnerability.\n\n* CVE-2019-1387: it is possible to let a submodule's git\n  directory point into a sibling's submodule directory, which may\n  result in overwriting parts of the Git repository and thus lead\n  to arbitrary command execution. As libgit2 doesn't provide any\n  way to do submodule clones natively, it is not susceptible to\n  this vulnerability. Users of libgit2 that have implemented\n  recursive submodule clones manually are encouraged to review\n their implementation for this vulnerability.\n","modified":"2026-04-16T04:42:02.822142954Z","published":"2019-12-15T18:03:05Z","upstream":["CVE-2019-1348","CVE-2019-1350","CVE-2019-1387"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2019-0391.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=25348"},{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v0.28.3"},{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v0.28.4"}],"affected":[{"package":{"name":"libgit2","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/libgit2?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4-1.mga7"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2019-0391.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}