CVE-2020-12279

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-706

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733vPatch, Third Party Advisory
https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4Patch, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release Notes, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733vPatch, Third Party Advisory
https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4Patch, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release Notes, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-12287.5<p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited CVE-2020-122806.5iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.CVE-2020-122816.5iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.CVE-2020-122828.8iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (Thi CVE-2020-122836.1Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/front CVE-2020-122849.8cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling be CVE-2020-122864.3In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped CVE-2020-122877.8Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentia CVE-2020-122885.5Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of se CVE-2020-122895.5Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via CVE-2020-12294.3A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, a CVE-2020-122905.5Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service