{"schemaVersion":3,"id":"GHSA-22Q8-GHMQ-63VF","aliases":["RUSTSEC-2024-0013"],"status":"published","duplicateOf":null,"title":null,"description":"Memory corruption, denial of service, and arbitrary code execution in libgit2\n\nThe [libgit2](https://github.com/libgit2/libgit2/) project fixed three security issues in the 1.7.2 release. These issues are:\n\n* The `git_revparse_single` function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the `git2` crate via the [`Repository::revparse_single`](https://docs.rs/git2/latest/git2/struct.Repository.html#method.revparse_single) method.\n* The `git_index_add` function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the `git2` crate via the [`Index::add`](https://docs.rs/git2/latest/git2/struct.Index.html#method.add) method.\n* The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.\n\nThe `libgit2-sys` crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of `libgit2-sys` bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.\n\nIt is recommended that all users upgrade.","dates":{"published":"2024-02-06T12:00:00.000Z","modified":"2026-02-04T03:46:03.412Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.6,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","computed":true,"selection":"version-preference"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":8.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","exploitability":10,"impact":7.8,"computed":true}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"Crates.Io","product":"libgit2-sys","name":"libgit2-sys","label":"libgit2-sys","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/libgit2-sys","purlType":"cargo","versions":[{"text":"< 0.16.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.0.0-0, < 0.16.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.16.2 | ≥ 0.0.0-0, < 0.16.2","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/rust-lang/git2-rs/pull/1017","label":"github.com/rust-lang/git2-rs/pull/1017","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/rust-lang/git2-rs/commit/9e57876be78924c1e5f3f268bb599e3981fe58bb","label":"github.com/rust-lang/git2-rs/commit/9e57876be78924c1e5f3f268bb599e3981fe58bb","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/rust-lang/git2-rs","label":"github.com/rust-lang/git2-rs","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0013.html","label":"rustsec.org/advisories/RUSTSEC-2024-0013.html","hostname":"rustsec.org","tags":["WEB","Advisory"]},{"url":"https://crates.io/crates/libgit2-sys","label":"crates.io/crates/libgit2-sys","hostname":"crates.io","tags":["PACKAGE"]},{"url":"https://github.com/libgit2/libgit2/releases/tag/v1.7.2","label":"github.com/libgit2/libgit2/releases/tag/v1.7.2","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["CGA-274C-M7W7-4572","CGA-2GVF-MC8P-W2GW","CGA-5M67-7F92-CVW7","CGA-Q3P8-FRR9-8WPF"],"duplicates":[],"related":["CGA-MGR7-Q997-PHWG","CGA-PVW4-G48W-C2M3","CVE-2024-24575","CVE-2024-24577"]},"timeline":[{"kind":"published","date":"2024-02-06T12:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:46:03.412Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T15:05:57.749Z","stale":false,"partial":false}}