cvelistv5 - cve-2017-5338

CVE-2017-5338 (GCVE-0-2017-5338)

Vulnerability from cvelistv5 – Published: 2017-04-11 16:00 – Updated: 2017-04-11 15:57

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2017-04-11T15:57:02",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-5338",
    "datePublished": "2017-04-11T16:00:00",
    "dateRejected": "2017-04-11T15:57:02",
    "dateReserved": "2017-01-10T00:00:00",
    "dateUpdated": "2017-04-11T15:57:02",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none\"}]",
      "id": "CVE-2017-5338",
      "lastModified": "2023-11-07T02:49:23.747",
      "published": "2017-04-11T16:59:00.267",
      "sourceIdentifier": "security@debian.org",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-5338\",\"sourceIdentifier\":\"security@debian.org\",\"published\":\"2017-04-11T16:59:00.267\",\"lastModified\":\"2023-11-07T02:49:23.747\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none\"}],\"metrics\":{},\"references\":[]}}"
  }
}

FKIE_CVE-2017-5338

Vulnerability from fkie_nvd - Published: 2017-04-11 16:59 - Updated: 2023-11-07 02:49

Severity ?

Summary

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none"
    }
  ],
  "id": "CVE-2017-5338",
  "lastModified": "2023-11-07T02:49:23.747",
  "metrics": {},
  "published": "2017-04-11T16:59:00.267",
  "references": [],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Rejected"
}

GSD-2017-5338

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Aliases

CVE-2017-5338

Aliases

CVE-2017-5338

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-5338",
    "description": "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
    "id": "GSD-2017-5338",
    "references": [
      "https://www.suse.com/security/cve/CVE-2017-5338.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-5338"
      ],
      "details": "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
      "id": "GSD-2017-5338",
      "modified": "2023-12-13T01:21:13.467936Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2017-5338",
        "STATE": "REJECT"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
          }
        ]
      }
    }
  }
}

SUSE-SU-2017:0433-1

Vulnerability from csaf_suse - Published: 2017-02-09 10:17 - Updated: 2017-02-09 10:17

Summary

Security update for libgit2

Notes

Title of the patch

Security update for libgit2

Description of the patch

This update for libgit2 fixes the several issues. These security issues were fixed: - CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).

Patchnames

SUSE-SLE-SDK-12-SP2-2017-220

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libgit2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for libgit2 fixes the several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SDK-12-SP2-2017-220",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0433-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2017:0433-1",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170433-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2017:0433-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-February/002635.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1019036",
        "url": "https://bugzilla.suse.com/1019036"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1019037",
        "url": "https://bugzilla.suse.com/1019037"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10128 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10128/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10129 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10129/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10130 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5338 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5339 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5339/"
      }
    ],
    "title": "Security update for libgit2",
    "tracking": {
      "current_release_date": "2017-02-09T10:17:43Z",
      "generator": {
        "date": "2017-02-09T10:17:43Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2017:0433-1",
      "initial_release_date": "2017-02-09T10:17:43Z",
      "revision_history": [
        {
          "date": "2017-02-09T10:17:43Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgit2-24-0.24.1-6.1.x86_64",
                "product": {
                  "name": "libgit2-24-0.24.1-6.1.x86_64",
                  "product_id": "libgit2-24-0.24.1-6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-24-0.24.1-6.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        },
        "product_reference": "libgit2-24-0.24.1-6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-10128",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10128"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10128",
          "url": "https://www.suse.com/security/cve/CVE-2016-10128"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019036 for CVE-2016-10128",
          "url": "https://bugzilla.suse.com/1019036"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-09T10:17:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10128"
    },
    {
      "cve": "CVE-2016-10129",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10129"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10129",
          "url": "https://www.suse.com/security/cve/CVE-2016-10129"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019036 for CVE-2016-10129",
          "url": "https://bugzilla.suse.com/1019036"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-09T10:17:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10129"
    },
    {
      "cve": "CVE-2016-10130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10130",
          "url": "https://www.suse.com/security/cve/CVE-2016-10130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2016-10130",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-09T10:17:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10130"
    },
    {
      "cve": "CVE-2017-5338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5338",
          "url": "https://www.suse.com/security/cve/CVE-2017-5338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2017-5338",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-09T10:17:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5338"
    },
    {
      "cve": "CVE-2017-5339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5339",
          "url": "https://www.suse.com/security/cve/CVE-2017-5339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2017-5339",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libgit2-24-0.24.1-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-09T10:17:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5339"
    }
  ]
}

CNVD-2017-00486

Vulnerability from cnvd - Published: 2017-01-17

Title

libgit2安全绕过漏洞

Description

libgit2是一个可移植、使用C语言实现的Git核心开发包。 libgit20.25版本和0.24版本中的badssl.c文件存在安全绕过漏洞。攻击者可利用该漏洞实施中间人攻击，绕过安全限制并执行未授权的操作。

Severity

中

Patch Name

libgit2安全绕过漏洞的补丁

Patch Description

libgit2是一个可移植、使用C语言实现的Git核心开发包。 libgit20.25版本和0.24版本中的badssl.c文件存在安全绕过漏洞。攻击者可利用该漏洞实施中间人攻击，绕过安全限制并执行未授权的操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/libgit2/libgit2

Reference

http://www.securityfocus.com/bid/95354

Impacted products

Name
['libgit2 libgit2 0.24', 'libgit2 libgit2 0.25']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95354"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5338"
    }
  },
  "description": "libgit2\u662f\u4e00\u4e2a\u53ef\u79fb\u690d\u3001\u4f7f\u7528C\u8bed\u8a00\u5b9e\u73b0\u7684Git\u6838\u5fc3\u5f00\u53d1\u5305\u3002\r\n\r\nlibgit20.25\u7248\u672c\u548c0.24\u7248\u672c\u4e2d\u7684badssl.c\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bd\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "libgit2",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/libgit2/libgit2",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-00486",
  "openTime": "2017-01-17",
  "patchDescription": "libgit2\u662f\u4e00\u4e2a\u53ef\u79fb\u690d\u3001\u4f7f\u7528C\u8bed\u8a00\u5b9e\u73b0\u7684Git\u6838\u5fc3\u5f00\u53d1\u5305\u3002\r\n\r\nlibgit20.25\u7248\u672c\u548c0.24\u7248\u672c\u4e2d\u7684badssl.c\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bd\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "libgit2\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "libgit2 libgit2 0.24",
      "libgit2 libgit2 0.25"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/95354",
  "serverity": "\u4e2d",
  "submitTime": "2017-01-13",
  "title": "libgit2\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

OPENSUSE-SU-2017:0405-1

Vulnerability from csaf_opensuse - Published: 2017-02-06 12:58 - Updated: 2017-02-06 12:58

Summary

Security update for libgit2

Notes

Title of the patch

Security update for libgit2

Description of the patch

This update for libgit2 to version 0.24.6 fixes the following issues: - CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).

Patchnames

openSUSE-2017-216

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libgit2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for libgit2 to version 0.24.6 fixes the following issues:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2017-216",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2017_0405-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1019036",
        "url": "https://bugzilla.suse.com/1019036"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1019037",
        "url": "https://bugzilla.suse.com/1019037"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10128 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10128/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10129 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10129/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10130 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5338 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5339 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5339/"
      }
    ],
    "title": "Security update for libgit2",
    "tracking": {
      "current_release_date": "2017-02-06T12:58:42Z",
      "generator": {
        "date": "2017-02-06T12:58:42Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2017:0405-1",
      "initial_release_date": "2017-02-06T12:58:42Z",
      "revision_history": [
        {
          "date": "2017-02-06T12:58:42Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgit2-24-0.24.6-10.1.aarch64",
                "product": {
                  "name": "libgit2-24-0.24.6-10.1.aarch64",
                  "product_id": "libgit2-24-0.24.6-10.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libgit2-devel-0.24.6-10.1.aarch64",
                "product": {
                  "name": "libgit2-devel-0.24.6-10.1.aarch64",
                  "product_id": "libgit2-devel-0.24.6-10.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgit2-24-0.24.6-10.1.s390x",
                "product": {
                  "name": "libgit2-24-0.24.6-10.1.s390x",
                  "product_id": "libgit2-24-0.24.6-10.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libgit2-devel-0.24.6-10.1.s390x",
                "product": {
                  "name": "libgit2-devel-0.24.6-10.1.s390x",
                  "product_id": "libgit2-devel-0.24.6-10.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgit2-24-0.24.6-10.1.x86_64",
                "product": {
                  "name": "libgit2-24-0.24.6-10.1.x86_64",
                  "product_id": "libgit2-24-0.24.6-10.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libgit2-devel-0.24.6-10.1.x86_64",
                "product": {
                  "name": "libgit2-devel-0.24.6-10.1.x86_64",
                  "product_id": "libgit2-devel-0.24.6-10.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 12 SP1",
                "product": {
                  "name": "SUSE Package Hub 12 SP1",
                  "product_id": "SUSE Package Hub 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-24-0.24.6-10.1.aarch64 as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64"
        },
        "product_reference": "libgit2-24-0.24.6-10.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-24-0.24.6-10.1.s390x as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x"
        },
        "product_reference": "libgit2-24-0.24.6-10.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-24-0.24.6-10.1.x86_64 as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64"
        },
        "product_reference": "libgit2-24-0.24.6-10.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-devel-0.24.6-10.1.aarch64 as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64"
        },
        "product_reference": "libgit2-devel-0.24.6-10.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-devel-0.24.6-10.1.s390x as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x"
        },
        "product_reference": "libgit2-devel-0.24.6-10.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgit2-devel-0.24.6-10.1.x86_64 as component of SUSE Package Hub 12 SP1",
          "product_id": "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        },
        "product_reference": "libgit2-devel-0.24.6-10.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-10128",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10128"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10128",
          "url": "https://www.suse.com/security/cve/CVE-2016-10128"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019036 for CVE-2016-10128",
          "url": "https://bugzilla.suse.com/1019036"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-06T12:58:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10128"
    },
    {
      "cve": "CVE-2016-10129",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10129"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10129",
          "url": "https://www.suse.com/security/cve/CVE-2016-10129"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019036 for CVE-2016-10129",
          "url": "https://bugzilla.suse.com/1019036"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-06T12:58:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10129"
    },
    {
      "cve": "CVE-2016-10130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10130",
          "url": "https://www.suse.com/security/cve/CVE-2016-10130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2016-10130",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-06T12:58:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10130"
    },
    {
      "cve": "CVE-2017-5338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5338",
          "url": "https://www.suse.com/security/cve/CVE-2017-5338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2017-5338",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-06T12:58:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5338"
    },
    {
      "cve": "CVE-2017-5339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
          "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5339",
          "url": "https://www.suse.com/security/cve/CVE-2017-5339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019037 for CVE-2017-5339",
          "url": "https://bugzilla.suse.com/1019037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-24-0.24.6-10.1.x86_64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.aarch64",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.s390x",
            "SUSE Package Hub 12 SP1:libgit2-devel-0.24.6-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-02-06T12:58:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5339"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2017-5338 (GCVE-0-2017-5338)

FKIE_CVE-2017-5338

GSD-2017-5338

SUSE-SU-2017:0433-1

CNVD-2017-00486

OPENSUSE-SU-2017:0405-1

Tags

Sightings

Nomenclature