CVE-2023-22742: libgit2 fails to verify SSH keys by default
First published: Fri Jan 20 2023(Updated: )
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libgit2 Libgit2 | <1.4.5 | |
| Libgit2 Libgit2 | =1.5.0 | |
| ubuntu/libgit2 | <0.26.0+dfsg.1-1.1ubuntu0.2+ | 0.26.0+dfsg.1-1.1ubuntu0.2+ |
| ubuntu/libgit2 | <1.4.5<1.5.1+ | 1.4.5 1.5.1+ |
| ubuntu/libgit2 | <0.28.4+dfsg.1-2ubuntu0.1 | 0.28.4+dfsg.1-2ubuntu0.1 |
| ubuntu/libgit2 | <1.1.0+dfsg.1-4.1ubuntu0.1 | 1.1.0+dfsg.1-4.1ubuntu0.1 |
| ubuntu/libgit2 | <0.24.1-2ubuntu0.2+ | 0.24.1-2ubuntu0.2+ |
| debian/libgit2 | <=0.27.7+dfsg.1-0.2 | 0.27.7+dfsg.1-0.2+deb10u2 1.1.0+dfsg.1-4+deb11u1 1.1.0+dfsg.1-4+deb11u2 1.5.1+ds-1 1.5.1+ds-1+deb12u1 1.7.2+ds-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56
- https://github.com/libgit2/libgit2/commit/cd6f679af401eda1f172402006ef8265f8bd58ea
- https://github.com/libgit2/libgit2/releases/tag/v1.4.5
- https://github.com/libgit2/libgit2/releases/tag/v1.5.1
- https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq
- https://www.libssh2.org
- http://www.openwall.com/lists/oss-security/2023/11/06/5
- https://launchpad.net/bugs/cve/CVE-2023-22742
- https://security-tracker.debian.org/tracker/CVE-2023-22742
- https://ubuntu.com/security/notices/USN-6678-1
- https://www.cve.org/CVERecord?id=CVE-2023-22742
- https://nvd.nist.gov/vuln/detail/CVE-2023-22742
- https://ubuntu.com/security/CVE-2023-22742
Frequently Asked Questions
What is CVE-2023-22742?
CVE-2023-22742 is a vulnerability in libgit2, a cross-platform linkable library implementation of Git.
How does CVE-2023-22742 affect libgit2?
CVE-2023-22742 affects libgit2 by not performing certificate checking when using an SSH remote with the optional libssh2 backend.
What is the severity of CVE-2023-22742?
CVE-2023-22742 has a severity level of medium.
How can I fix CVE-2023-22742?
To fix CVE-2023-22742, update libgit2 to version 1.5.0 or later, or apply the appropriate patches.
What is CWE-347?
CWE-347 is a weakness that describes improper validation of certificate with host mismatch.
- collector/nvd-index
- collector/mitre-cve
- agent/type
- agent/remedy
- agent/title
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/author
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/event
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/trending
- agent/tags
- agent/source
- vendor/libgit2
- canonical/libgit2 libgit2
- version/libgit2 libgit2/1.5.0
- package-manager/debian
- package-manager/ubuntu