Infinite Loop and Memory Leak Vulnerability in libgit2 Prior to 1.6.5 and 1.7.2
CVE-2024-24575
7.5HIGH
What is CVE-2024-24575?
The vulnerability in libgit2 arises from the function git_revparse_single, which may enter an infinite loop due to a crafted input. This can lead to a Denial of Service in applications utilizing libgit2 by continuously parsing improperly formatted user input. The problematic loop condition allows the manipulation of memory access beyond intended bounds, potentially leaking sensitive information if the user-specified revision string is echoed back to the attacker. As a proactive measure, users are strongly advised to upgrade to libgit2 versions 1.6.5 or 1.7.2, as these releases contain patches that mitigate this risk.
Affected Version(s)
libgit2 >= 1.4.0, < 1.6.5 < 1.4.0, 1.6.5
libgit2 >= 1.7.0, < 1.7.2 < 1.7.0, 1.7.2