Bug 1554366 (CVE-2018-8098, CVE-2018-8099)

Summary: CVE-2018-8099 CVE-2018-8098 libgit2: denial of service (DoS) via crafted repository index files
Product: [Other] Security Response Reporter: Laura Pardo <lpardo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: i, icq, veeti.paananen, walter.pete
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libgit2 0.26.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:05:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1554367, 1554368, 1554374    
Bug Blocks:    

Description Laura Pardo 2018-03-12 14:08:28 UTC 
Several flaws were found in libgit2 before version 0.26.2. There are memory handling issues when reading crafted repository index files. The issues allow for possible denial of service due to allocation of large memory and out-of-bound reads. As the index is never transferred via the network, exploitation requires an attacker to have access to the local repository.


References:
https://github.com/libgit2/libgit2/commit/dd2d5381773ca3f7bc31f56aea6fc067db5ea404
Comment 1 Laura Pardo 2018-03-12 14:09:08 UTC 
Created libgit2 tracking bugs for this issue:

Affects: fedora-all [bug 1554368]
Affects: epel-all [bug 1554367]
Comment 3 Laura Pardo 2018-03-21 17:32:46 UTC 
References added for CVE-2018-8098:
https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0
https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1

References added for CVE-2018-8099:
https://github.com/libgit2/libgit2/commit/58a6fe94cb851f71214dbefac3f9bffee437d6fe
Comment 4 Product Security DevOps Team 2019-07-12 13:05:09 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-8098
https://access.redhat.com/security/cve/cve-2018-8099