CVE-2023-22742: libgit2 fails to verify SSH keys by default

Q: What is CVE-2023-22742?

CVE-2023-22742 is a vulnerability in libgit2, a cross-platform linkable library implementation of Git.

Q: How does CVE-2023-22742 affect libgit2?

CVE-2023-22742 affects libgit2 by not performing certificate checking when using an SSH remote with the optional libssh2 backend.

Q: What is the severity of CVE-2023-22742?

CVE-2023-22742 has a severity level of medium.

Q: How can I fix CVE-2023-22742?

To fix CVE-2023-22742, update libgit2 to version 1.5.0 or later, or apply the appropriate patches.

Q: What is CWE-347?

CWE-347 is a weakness that describes improper validation of certificate with host mismatch.

Published Jan 20, 2023

Updated

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Affected Software

9 affected componentsFixes available

debian/libgit2<=0.27.7+dfsg.1-0.2

0.27.7+dfsg.1-0.2+deb10u21.1.0+dfsg.1-4+deb11u11.1.0+dfsg.1-4+deb11u21.5.1+ds-11.5.1+ds-1+deb12u11.7.2+ds-1

ubuntu/libgit2<0.26.0+dfsg.1-1.1ubuntu0.2+

0.26.0+dfsg.1-1.1ubuntu0.2+

ubuntu/libgit2<0.28.4+dfsg.1-2ubuntu0.1

0.28.4+dfsg.1-2ubuntu0.1

ubuntu/libgit2<1.1.0+dfsg.1-4.1ubuntu0.1

1.1.0+dfsg.1-4.1ubuntu0.1

ubuntu/libgit2<1.4.5, <1.5.1+

1.4.51.5.1+

ubuntu/libgit2<0.24.1-2ubuntu0.2+

0.24.1-2ubuntu0.2+

libgit2 libgit2<1.4.5

libgit2 libgit2=1.5.0

alpine/libgit2<1.5.1-r0

1.5.1-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libgit2 to a version that resolves this vulnerability.
Fixed in 0.27.7+dfsg.1-0.2+deb10u2Fixed in 1.1.0+dfsg.1-4+deb11u1Fixed in 1.1.0+dfsg.1-4+deb11u2Fixed in 1.5.1+ds-1Fixed in 1.5.1+ds-1+deb12u1Fixed in 1.7.2+ds-1
Upgrade
Upgrade ubuntu/libgit2 to a version that resolves this vulnerability.
Fixed in 0.26.0+dfsg.1-1.1ubuntu0.2+
Upgrade
Upgrade ubuntu/libgit2 to a version that resolves this vulnerability.
Fixed in 0.28.4+dfsg.1-2ubuntu0.1
Upgrade
Upgrade ubuntu/libgit2 to a version that resolves this vulnerability.
Fixed in 1.1.0+dfsg.1-4.1ubuntu0.1
Upgrade
Upgrade ubuntu/libgit2 to a version that resolves this vulnerability.
Fixed in 1.4.5Fixed in 1.5.1+
Upgrade
Upgrade ubuntu/libgit2 to a version that resolves this vulnerability.
Fixed in 0.24.1-2ubuntu0.2+
Upgrade
Upgrade alpine/libgit2 to a version that resolves this vulnerability.
Fixed in 1.5.1-r0
Upgrade
Upgrade libgit2 to a version that resolves this vulnerability.
Fixed in v1.4.5
Upgrade
Upgrade libgit2 to a version that resolves this vulnerability.
Fixed in v1.5.1
Configuration
Set the certificate_check field of libgit2's git_remote_callbacks structure so certificate checking is performed.
libgit2 certificate_check = configured
Compensating control
If unable to upgrade libgit2, manually check all relevant certificates, including server SSH keys when using an SSH remote with the optional libssh2 backend.

Event History

Jan 20, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·10:49 PM

Data Sourced

via MITRE·10:49 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·11:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-6678-1

Frequently Asked Questions

What is CVE-2023-22742?

CVE-2023-22742 is a vulnerability in libgit2, a cross-platform linkable library implementation of Git.

How does CVE-2023-22742 affect libgit2?