Skip to content
Fencer Vulns
medium 5.3

CVE-2023-22742 json

libgit2 fails to verify SSH keys by default

published 2023-01-20 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-26860 , GHSA-8643-3wh5-rmjq , GHSA-m4ch-rfv5-x5g3 , JLSEC-2025-184 , RUSTSEC-2023-0003

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Patch / fix

  • crates.io libgit2-sys 0.13.5, 0.14.2
  • crates.io git2 0.16.1
  • julia LibGit2_jll 1.6.1+0
  • libgit2 libgit2 1.4.5
  • libgit2 Debian 14, Debian 13, Debian 12 1.5.1+ds-1

debian advisories DEBIAN-CVE-2023-22742

  • libgit2 Ubuntu 20.04 LTS 0.28.4+dfsg.1-2ubuntu0.1
  • libgit2 Ubuntu 22.04 LTS 1.1.0+dfsg.1-4.1ubuntu0.1
  • libgit2 Ubuntu Pro 16.04 LTS 0.24.1-2ubuntu0.2+esm2
  • libgit2 Ubuntu Pro 18.04 LTS 0.26.0+dfsg.1-1.1ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2023-22742

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libgit2 SLE Real Time 15 SP3, openSUSE Leap 15.4, Manager Server Module 4.3 +1 more 0.28.4-150200.3.6.1
  • libgit2 SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 1.3.0-150400.3.6.1
  • libgit2 openSUSE Leap 15.4 0.26.8-150000.3.18.1

suse advisories SUSE-SU-2023:1909-1SUSE-SU-2023:1788-1SUSE-SU-2023:1570-1

  • libgit2 openSUSE Tumbleweed 1.5.1-1.1

opensuse advisories openSUSE-SU-2024:12632-1

  • libgit2 Alpine 3.17 1.5.1-r0

alpine advisories ALPINE-CVE-2023-22742

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rust CBL-Mariner 2.0 1.68.0-1

azure linux advisories AZL-13175

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-22742 updated cvss 5.3

libgit2: fails to verify SSH keys by default

  • Red Hat Enterprise Linux 7 libgit2
    affected: workaround, no fix planned “Upgrade the package as soon as possible. Users unable to upgrade should ensure that all relevant certificates are manually checked.”
  • Red Hat Enterprise Linux 8 libgit2 Red Hat Enterprise Linux 9 rust, cargo, clippy, rustfmt, rust-gdb, rust-src, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 5.3

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
crates.io libgit2-sys
>=0.14.0, <0.14.2
<0.13.5
>=0.0.0-0, <0.13.5
0.14.2
0.13.5
crates.io git2
<0.16.1
0.16.1
julia LibGit2_jll
<1.6.1+0
1.6.1+0

Affected products

  • libgit2 libgit2

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.