CVE-2023-22742 libgit2 fails to verify SSH keys by default
libgit2 fails to verify SSH keys by default, allowing man-in-the-middle attacks unless a certificate check callback is explicitly configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-22742?
CVE-2023-22742 is a medium-severity vulnerability in libgit2, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.
Weakness: CWE-347
Which versions are affected by CVE-2023-22742?
7 open source packages ship an affected version, including libgit2-sys and git2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libgit2-sys crates.io | All versions | 0.13.5 |
libgit2-sys crates.io | All versions | 0.13.5 |
libgit2-sys crates.io | From 0.0.0-0 | 0.13.5, 0.14.2 |
libgit2-sys crates.io | From 0.14.0 | 0.14.2 |
libgit2-sys crates.io | From 0.14.0 | 0.14.2 |
git2 crates.io | All versions | 0.16.1 |
1 more packages
git2 crates.io | All versions | 0.16.1 |
Linux distribution packages (8)
libgit2 SUSE:Linux Enterprise Module for Development Tools 15 SP4 | All versions | 1.3.0-150400.3.6.1 |
libgit2 SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 0.28.4-150200.3.6.1 |
libgit2 SUSE:Manager Server Module 4.2 | All versions | 0.28.4-150200.3.6.1 |
libgit2 SUSE:Manager Server Module 4.3 | All versions | 0.28.4-150200.3.6.1 |
libgit2 openSUSE:Leap 15.4 | All versions | 0.26.8-150000.3.18.1 |
libgit2 openSUSE:Leap 15.4 | All versions | 0.28.4-150200.3.6.1 |
libgit2 openSUSE:Leap 15.4 | All versions | 1.3.0-150400.3.6.1 |
libgit2 openSUSE:Tumbleweed | All versions | 1.5.1-1.1 |
Products include Libgit2 Libgit2.
How do I fix CVE-2023-22742?
Upgrade libgit2-sys to a fixed version for your release line: 0.13.5 or 0.14.2.
Is CVE-2023-22742 being exploited?
There is no known exploitation of CVE-2023-22742 in the wild and no public exploit code.
Other vulnerabilities in libgit2
Sources
Also known as AZL-13175, DEBIAN-CVE-2023-22742, GHSA-8643-3wh5-rmjq, GHSA-m4ch-rfv5-x5g3, JLSEC-2025-184, OESA-2023-1957 and 6 more.