PT-2023-1296 · Libgit2+7 · Libgit2+7

Published 2023-01-20 · Updated 2024-07-29 · CVE-2023-22742

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 1.4.5 libgit2 versions prior to 1.5.1

Description The issue is related to the lack of certificate checking by default when using an SSH remote with the optional libssh2 backend in libgit2. This means that clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to update to a newer version to mitigate the risk. The certificate check field of libgit2's git remote callbacks structure must be set to perform certificate checking. If a certificate check callback is not set, libgit2 does not perform any certificate checking.

Recommendations For libgit2 versions prior to 1.4.5, update to version 1.4.5 or later. For libgit2 versions prior to 1.5.1, update to version 1.5.1 or later. As a temporary workaround, consider setting the certificate check field of libgit2's git remote callbacks structure to perform certificate checking. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2023-1559

ALT-PU-2024-7165

AZL-13175

BDU:2023-00574

CVE-2023-22742

DLA-3340-1

GHSA-8643-3WH5-RMJQ

GHSA-M4CH-RFV5-X5G3

MGASA-2024-0059

OESA-2023-1957

OPENSUSE-SU-2024:12632-1

ROSA-SA-2023-2235

RUSTSEC-2023-0003

SUSE-SU-2023:1570-1

SUSE-SU-2023:1788-1

SUSE-SU-2023:1909-1

SUSE-SU-2023_1788-1

SUSE-SU-2023_1909-1

USN-6678-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

Libgit2

Libssh2

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22742.json · Exploit
• https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56 · Patch
• https://github.com/libgit2/libgit2/commit/cd6f679af401eda1f172402006ef8265f8bd58ea · Patch
• https://osv.dev/vulnerability/USN-6678-1 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2023-0003 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0059 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22742 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1570-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22742 · Security Note
• https://advisories.mageia.org/MGASA-2024-0059.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22742 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22742 · Security Note
• https://osv.dev/vulnerability/GHSA-m4ch-rfv5-x5g3 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3340-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22742 · Vendor Advisory