libgit2 up to 0.27.2 Sign Extension delta.c git_delta_apply out-of-bounds

Summaryinfo

A vulnerability has been found in libgit2 up to 0.27.2 and classified as critical. Affected is the function git_delta_apply of the file delta.c of the component Sign Extension. Performing a manipulation results in out-of-bounds. This vulnerability is identified as CVE-2018-10887. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in libgit2 up to 0.27.2. This affects the function git_delta_apply of the file delta.c of the component Sign Extension. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

The bug was discovered 07/11/2018. The weakness was released 07/10/2018 as Bug 1598021 as confirmed bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2018-10887 since 05/09/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 111019 (FreeBSD : Libgit2 -- multiple vulnerabilities (3c9b7698-84da-11e8-8c75-d8cb8abf62dd)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 171683 (SUSE Enterprise Linux Security Update for libgit2 (SUSE-SU-2018:3440-1)).

Upgrading to version 0.27.3 eliminates this vulnerability. A possible mitigation has been published 1 days after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (111019) and SecurityFocus (BID 104345†). Entries connected to this vulnerability are available at VDB-114492, VDB-118361, VDB-121132 and VDB-123017. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• libgit2

Version

• 0.27.0
• 0.27.1
• 0.27.2

License

• open-source

Website

• Product: https://github.com/libgit2/libgit2/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion