Several flaws were found in libgit2 before version 0.26.2. There are memory handling issues when reading crafted repository index files. The issues allow for possible denial of service due to allocation of large memory and out-of-bound reads. As the index is never transferred via the network, exploitation requires an attacker to have access to the local repository. References: https://github.com/libgit2/libgit2/commit/dd2d5381773ca3f7bc31f56aea6fc067db5ea404
Created libgit2 tracking bugs for this issue: Affects: fedora-all [bug 1554368] Affects: epel-all [bug 1554367]
References added for CVE-2018-8098: https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0 https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1 References added for CVE-2018-8099: https://github.com/libgit2/libgit2/commit/58a6fe94cb851f71214dbefac3f9bffee437d6fe
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-8098 https://access.redhat.com/security/cve/cve-2018-8099