Critical severity9.8NVD Advisory· Published Apr 27, 2020· Updated Jun 17, 2026

CVE-2020-12279

Description

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libgit2/Libgit2
cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*
Range: <0.28.4
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
libgit2/libgit2description
Libgit2 Project/Libgit2llm-fuzzy
Range: <0.28.4, <0.99.0

Patches

Vulnerability mechanics

References

github.com/git/git/security/advisories/GHSA-589j-mmg9-733vnvdPatchThird Party Advisory
github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4nvdPatchThird Party Advisory
github.com/libgit2/libgit2/releases/tag/v0.28.4nvdRelease NotesThird Party Advisory
github.com/libgit2/libgit2/releases/tag/v0.99.0nvdRelease NotesThird Party Advisory
lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2023/02/msg00034.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000