drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in libgit2
Name: |
Mehrere Probleme in libgit2 |
|
ID: |
USN-6678-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 16.04 LTS (Available with Ubuntu Pro), Ubuntu 18.04 LTS (Available with Ubuntu Pro), Ubuntu 23.10 |
|
Datum: |
Mi, 6. März 2024, 18:02 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12279
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12278
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24577
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22742
https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1
https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1 |
|
Applikationen: |
Git |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============3032079738506643170== Content-Language: en-US Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------ZnR9UrbnPykKrj5krnBPTZpf"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------ZnR9UrbnPykKrj5krnBPTZpf Content-Type: multipart/mixed; boundary="------------kLa7iJUW0ue1vVZHSRG406fl"; protected-headers="v1" From: Fabian Toepfer <fabian.toepfer@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <55279c62-da5c-4e3e-a14e-0949acca824c@canonical.com> Subject: [USN-6678-1] libgit2 vulnerabilities
--------------kLa7iJUW0ue1vVZHSRG406fl Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64
========================================================================== Ubuntu Security Notice USN-6678-1 March 05, 2024
libgit2 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in libgit2.
Software Description: - libgit2: Portable C implementation of the Git core methods library
Details:
It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)
It was discovered that libgit2 did not perform certificate checking by default. An attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)
It was discovered that libgit2 could be made to run into an infinite loop. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-24575)
It was discovered that libgit2 did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-24577)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.10: libgit2-1.5 1.5.1+ds-1ubuntu1.1
Ubuntu 22.04 LTS: libgit2-1.1 1.1.0+dfsg.1-4.1ubuntu0.1
Ubuntu 20.04 LTS: libgit2-28 0.28.4+dfsg.1-2ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro): libgit2-26 0.26.0+dfsg.1-1.1ubuntu0.2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro): libgit2-24 0.24.1-2ubuntu0.2+esm2
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-6678-1 CVE-2020-12278, CVE-2020-12279, CVE-2023-22742, CVE-2024-24575, CVE-2024-24577
Package Information: https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1 https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1 https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1
--------------kLa7iJUW0ue1vVZHSRG406fl--
--------------ZnR9UrbnPykKrj5krnBPTZpf Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc"
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmXna3EFAwAAAAAACgkQCAvK1QvD6SCt Tg//cIgUR2T+/E8+gQ9Mb9qijeRx87ntUNiIOkOoMbQp2C02sJH1WXA48BDcCv3fLRQtfxUrfk20 s9ErY58U4kBSgDhYmV4rsLED0q1TS5pNb+kRvyABSWGBZZUUEKICx1350mKNd4Y1kMl7ubVbJ+fr E3Ub5g5pvn0x7JLk1tDeOIjB2MbavgCakZ3TOJ+VbPMfMVW67OEYYmZ6xgZqITgCbkVooPXodFsl 2LtPUHSC/VaX1BtXWE8QP7WQMcx+5Afd2wnZSNuHhvXK/T5x8oL2JvH3IpvpTNgNmjzipAaXGyGK isCUAOen84XEkXXFzCQOP8DCwzTeV+JhWLgyit/b+smHnpxyjS+abpS9cSXbPnZogWw6fYZIdwR0 xy+CcAluUtcc4H3orWdwW3QKcFhne2Kxv1RubRpzHkAfCQccW1K/rThqq+zp/qCEujgpnsWpFhM+ McriHDaPCuJVlOnTI0cGypLu+av19h2guk1KGZXwBJugd4qcXR4wEytWgtNoNeHcUh6lt07M9BnC Shtev1DmD1vpU+FPYta7Us5Vv+nZMv0kByQsE5JvFmLM9G/Avs/YRsN/dmwrhIZuA3lbMjCY6jxx 7LAFU8Bl5xKMyms+e3hDYKlGuin9W6nUWHIroir448ZPa877E/tSnIDdjQI8I/8pqkcYSmY66kid 7Aw= =0VCq -----END PGP SIGNATURE-----
--------------ZnR9UrbnPykKrj5krnBPTZpf--
--===============3032079738506643170== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
Cg==
--===============3032079738506643170==--
|
|
|
|