CVE catalog
CVE-2024-24575
libgit2: CVE-2024-24575
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.44% · Oct 25, 2026
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libgit2 | sid | 1.9.7+ds-1 | fixed |
| Debian | libgit2 | forky | 1.9.7+ds-1 | fixed |
| Debian | libgit2 | trixie | 1.9.0+ds-2+deb13u1 | fixed |
| Debian | libgit2 | trixie-security | 1.9.0+ds-2+deb13u1 | fixed |
| Debian | libgit2 | bookworm | 1.5.1+ds-1+deb12u1 | fixed |
| Debian | libgit2 | bookworm-security | 1.5.1+ds-1+deb12u2 | fixed |
| Opensuse | libgit2 | tumbleweed | 1.7.2-2.1 | fixed |
| Suse | libgit2 | linux enterprise module for development tools 15 sp6 | 1.7.2-150600.3.3.1 | fixed |
| Opensuse | libgit2 | leap 15.6 | 1.7.2-150600.3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libgit2 | source | sid | 1.7.2+ds-1 | not yet assigned | Not reported | [1063415] |
| Debian | libgit2 | source | forky | 1.7.2+ds-1 | not yet assigned | Not reported | [1063415] |
| Debian | libgit2 | source | trixie | 1.7.2+ds-1 | not yet assigned | Not reported | [1063415] |
| Debian | libgit2 | source | bookworm | 1.5.1+ds-1+deb12u1 | not yet assigned | Not reported | [1063415] |
| Opensuse | libgit2 | rpm | tumbleweed | 1.7.2-2.1 | Not reported | OPENSUSE-SU-2024:13675-1 | Not reported |
| Suse | libgit2 | rpm | linux enterprise module for development tools 15 sp6 | 1.7.2-150600.3.3.1 | Not reported | SUSE-SU-2024:2584-1 | Not reported |
| Opensuse | libgit2 | rpm | leap 15.6 | 1.7.2-150600.3.3.1 | Not reported | SUSE-SU-2024:2584-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_2584-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-24575]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2584-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13675-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-24575]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-24575.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]