Bug 1554366 (CVE-2018-8098, CVE-2018-8099) - CVE-2018-8099 CVE-2018-8098 libgit2: denial of service (DoS) via crafted repository index files
Summary: CVE-2018-8099 CVE-2018-8098 libgit2: denial of service (DoS) via crafted repo...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-8098, CVE-2018-8099
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1554367 1554368 1554374
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-03-12 14:08 UTC by Laura Pardo
Modified: 2019-09-29 14:35 UTC (History)
4 users (show)

Fixed In Version: libgit2 0.26.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-12 13:05:09 UTC


Attachments (Terms of Use)

Description Laura Pardo 2018-03-12 14:08:28 UTC
Several flaws were found in libgit2 before version 0.26.2. There are memory handling issues when reading crafted repository index files. The issues allow for possible denial of service due to allocation of large memory and out-of-bound reads. As the index is never transferred via the network, exploitation requires an attacker to have access to the local repository.


References:
https://github.com/libgit2/libgit2/commit/dd2d5381773ca3f7bc31f56aea6fc067db5ea404

Comment 1 Laura Pardo 2018-03-12 14:09:08 UTC
Created libgit2 tracking bugs for this issue:

Affects: fedora-all [bug 1554368]
Affects: epel-all [bug 1554367]

Comment 4 Product Security DevOps Team 2019-07-12 13:05:09 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-8098
https://access.redhat.com/security/cve/cve-2018-8099


Note You need to log in before you can comment on or make changes to this bug.