CVE-2024-24575— libgit2 资源管理错误漏洞

libgit2 is vulnerable to a denial of service attack in `git_revparse_single`

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

未加控制的资源消耗(资源穷尽)

libgit2 资源管理错误漏洞

libgit2是一个可移植、使用C语言实现的Git核心开发包。 libgit2 存在资源管理错误漏洞。攻击者利用该漏洞使用特制的“git_revparse_single”输入可能会导致函数进入无限循环，从而可能导致拒绝服务攻击。

N/A

N/A