PT-2023-1296 · Libgit2+7 · Libgit2+7
CVE-2023-22742
·
Publicado
2023-01-20
·
Atualizado
2024-07-29
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libgit2 versions prior to 1.4.5
libgit2 versions prior to 1.5.1
Description
The issue is related to the lack of certificate checking by default when using an SSH remote with the optional libssh2 backend in libgit2. This means that clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to update to a newer version to mitigate the risk. The
certificate check field of libgit2's git remote callbacks structure must be set to perform certificate checking. If a certificate check callback is not set, libgit2 does not perform any certificate checking.Recommendations
For libgit2 versions prior to 1.4.5, update to version 1.4.5 or later.
For libgit2 versions prior to 1.5.1, update to version 1.5.1 or later.
As a temporary workaround, consider setting the
certificate check field of libgit2's git remote callbacks structure to perform certificate checking.
Users unable to upgrade should ensure that all relevant certificates are manually checked.Exploit
Correção
Improper Verification of Cryptographic Signature
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Libgit2
Libssh2