CVE-2024-24575

A flaw was found in libgit2, a cross-platform, linkable library implementation of Git. This flaw allows an attacker using a specially-crafted payload to git_revparse_single and cause the function to enter an infinite loop. This issue potentially causes a denial of service attack in the calling application.

Cargo in Red Hat Enterprise Linux 8 & 9 does use a bundled libgit2. However, cargo does not call git_index_add directly, and the only indirect call I can find is via git_reset, which does not involve any externally-provided paths. Therefore, Red Hat Enterprise Linux should be Not Affected by this CVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.