{
  "cveId": "CVE-2020-12278",
  "url": "https://patchblox.com/security/cve/CVE-2020-12278",
  "summary": "CVE-2020-12278 is fixed in libgit2-26 on 1 platform by libgit2-26 0.26.0\u002Bdfsg.1-1.1ubuntu0.2\u002Besm1 (version 0.26.0\u002Bdfsg.1-1.1ubuntu0.2\u002Besm1), released February 6, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libgit2-26: An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0",
  "description": "An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.",
  "published": "2020-04-27T10:15:00Z",
  "severity": "Medium",
  "epss": 0.05238,
  "epssPercentile": 0.92579,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libgit2-26",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "0.26.0\u002Bdfsg.1-1.1ubuntu0.2\u002Besm1",
      "fix": "libgit2-26 0.26.0\u002Bdfsg.1-1.1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libgit2-26-0.26.0-dfsg.1-1.1ubuntu0.2-esm1",
      "released": "2024-02-06T14:16:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}