p PatchFirst

CVE-2023-22742

CVE-2023-22742 · libgit2 fails to verify SSH keys by default

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

CVSS 5.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libgit2

    Versions
    • < 1.4.5: Affected
    • = 1.5.0: Affected

    No fix published

  • libgit2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.5.1+ds-1

    Update to 1.5.1+ds-1

  • libgit2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.5.1+ds-1

    Update to 1.5.1+ds-1

  • libgit2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.5.1+ds-1

    Update to 1.5.1+ds-1

  • libgit2 Ubuntu:Pro:16.04:LTS

    Versions
    • 0.22.2-2
    • 0.23.1-1
    • 0.24.1-2
    • 0.24.1-2ubuntu0.2
    • 0.24.1-2ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: < 0.24.1-2ubuntu0.2+esm2

    Update to 0.24.1-2ubuntu0.2+esm2

  • libgit2 Ubuntu:Pro:18.04:LTS

    Versions
    • 0.25.1+really0.24.6-1
    • 0.26.0+dfsg.1-1.1
    • 0.26.0+dfsg.1-1.1build1
    • 0.26.0+dfsg.1-1.1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 0.26.0+dfsg.1-1.1ubuntu0.2+esm1

    Update to 0.26.0+dfsg.1-1.1ubuntu0.2+esm1

  • libgit2 Ubuntu:20.04:LTS

    Versions
    • 0.27.7+dfsg.1-0.2build1
    • 0.28.3+dfsg.1-1
    • 0.28.3+dfsg.1-1ubuntu1
    • 0.28.4+dfsg.1-2
    Affected ranges
    • ECOSYSTEM: < 0.28.4+dfsg.1-2ubuntu0.1

    Update to 0.28.4+dfsg.1-2ubuntu0.1

  • libgit2 Ubuntu:22.04:LTS

    Versions
    • 1.1.0+dfsg.1-4
    • 1.1.0+dfsg.1-4.1
    • 1.1.0+dfsg.1-4.1build1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg.1-4.1ubuntu0.1

    Update to 1.1.0+dfsg.1-4.1ubuntu0.1

Original sources

Check your server →