Advisories for Gem/Rugged package

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check …

An issue was discovered in libgit2, which is used by rugged gem: path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository.

An issue was discovered in libgit2, which is used by rugged gem: checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository.

There is a vulnerability in ng_pkt (transports/smart_pkt.c) in libgit2 which is wrapped by the rugged gem. A remote attacker can send a crafted smart-protocol ng packet that lacks a \0 byte to trigger an out-of-bounds read that leads to DoS.

A flaw was found in libgit2 which is wrapped by the rugged gem. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out-of-bound read, which allows reading before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

A flaw was found in libgit2 which is wrapped by the rugged gem. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.

An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Fixed versions of the gem depend on fixed versions of libgit2.