CVE-2020-12278: libgit2 +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-12278

CVSS 9.8 · Critical EPSS 5,2%

Kerentanan Use of Incorrectly-Resolved Name or Reference pada libgit2, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

Rincian

Terbit di NVD: 27 April 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-706: Use of Incorrectly-Resolved Name or Reference
EPSS (30 hari): 5,2% peluang dieksploitasi; lebih tinggi dari 92,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
libgit2	libgit2	Semua versi sebelum 0.28.4
debian	debian linux	Versi 9.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01 patch · advisory pihak ketiga
https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb patch · advisory pihak ketiga
https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj advisory pihak ketiga
https://github.com/libgit2/libgit2/releases/tag/v0.28.4 release notes · advisory pihak ketiga
https://github.com/libgit2/libgit2/releases/tag/v0.99.0 release notes · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.