-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.eclipse.jgit:org.eclipse.jgit | maven | < 3.5.3 | 3.5.3 |
| mercurial | pip | < 3.2.3 | 3.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of case-insensitive filesystems when validating tree entries. The libgit2 commit diff shows a critical change in src/tree.c's valid_entry_name function, replacing strcmp with strcasecmp to enforce case-insensitive checks for '.git'. While this example is from libgit2, JGit's vulnerability description explicitly states similar logic flaws in path validation. The JGit 3.5.3 release notes confirm they added checks for case variations and Unicode codepoints, implying the original validation functions lacked these safeguards. The function responsible for validating tree entry names (analogous to libgit2's valid_entry_name) would be the vulnerable component in JGit.