Man-in-the-Middle Vulnerability in libgit2: CVE-2016-10130
Summary
ALPINE-CVE-2016-10130: The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable. Affects libgit2 versions < 0.25.1-r0. Fixed in 0.25.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is designed to be used in applications that require Git functionality without the overhead of a full Git installation. This library is widely utilized in various applications for version control and source code management. However, certain versions of libgit2 are susceptible to a vulnerability that could allow attackers to spoof servers.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10130, arises from the http_connect function in transports/http.c in libgit2 versions prior to 0.24.6 and 0.25.x before 0.25.1. This flaw allows man-in-the-middle attackers to exploit the clobbering of the error variable, potentially leading to server spoofing. If an attacker successfully exploits this vulnerability, they could intercept and manipulate communications between the client and server, posing significant security risks.
How To Fix
Minimum fixed version
0.25.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing network security measures such as using VPNs or secure tunnels to mitigate the risk of man-in-the-middle attacks while using affected versions of libgit2.
Conclusion
CVE-2016-10130 is a significant vulnerability in libgit2 that can lead to man-in-the-middle attacks. It is crucial for users of affected versions to update to the latest patched versions to ensure the security of their applications. Implementing workarounds can provide temporary relief, but upgrading is the best long-term solution.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2016-10130 is a vulnerability in libgit2 that allows man-in-the-middle attackers to spoof servers by exploiting a flaw in the http_connect function.
Versions of libgit2 prior to 0.24.6 and 0.25.x before 0.25.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2016-10130 is 5.9, indicating a moderate level of severity.
If you cannot upgrade immediately, consider using network security measures such as VPNs or secure tunnels to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
