CVE-2016-10129

Buffer overflow in the git_pkt_parse_line function in Git Smart Protocol support in libgit2 before version 0.24.6 and 0.25.x before version 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

libgit2 before versions 1.8.6 and 1.9.5 performs a fixed-size strncmp in set_data without verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can cause format_str to advance beyond the pkt-line and the following memchr length calculation to underflow, leading to a heap out-of-bounds read that can crash a client during the first refs-advertisement packet.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in the built-in HTTP transport that allows following an offsite redirect and sending credentials to an untrusted host. An attacker controlling a trusted Git host or an open redirect can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in git_delta_apply that trusts the attacker-controlled res_sz value, potentially leading to excessive memory allocations and memory exhaustion. Malicious pack data can be supplied via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local repository.

libgit2 before versions 1.8.6 and 1.9.5 does not reject traversal components in a submodule path loaded from .gitmodules. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in verify_server_cert that uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. This causes rejection of matching IP addresses and acceptance of mismatched ones, allowing an attacker with a CA-trusted certificate to intercept connections to IP-literal HTTPS URLs.

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.