Spoofing Vulnerability in libgit2
Summary
CVE-2016-10130: The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable. Affects libgit2 across 3 version ranges.
< 0.25.1-r0
< 9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22
< b5c6a1b407b7f8b952bded2789593b68b1876211
Fixed in 0.25.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is an open-source library that provides a low-level API for interacting with Git repositories. It is widely used in various applications and frameworks to implement Git functionality. However, a vulnerability has been discovered in versions before 0.24.6 and 0.25.x before 0.25.1 that could allow man-in-the-middle attackers to spoof servers by manipulating the error variable during the HTTP connection process.
Vulnerability Detail
The vulnerability (CVE-2016-10130) originates from the http_connect function in the transports/http.c file of libgit2. By exploiting the clobbering of the error variable, attackers can deceive clients into connecting to malicious servers instead of legitimate ones. This can lead to various security risks, including unauthorized access to sensitive information, data manipulation, and potential remote code execution.
How To Fix
Minimum fixed version
0.25.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the HTTP transport in libgit2 and rely on other transport mechanisms, such as SSH or local file access. However, this may limit certain Git functionalities that require HTTP connections. Here's an example of how to disable the HTTP transport in libgit2 using code:
git_libgit2_opts(GIT_OPT_ENABLE_HTTP, 0);
Please note that this workaround should only be considered if updating to the latest version is not immediately feasible.
Conclusion
The spoofing vulnerability in libgit2 can have serious security implications, allowing attackers to deceive clients and potentially compromise sensitive information. It is crucial to update libgit2 to the latest version or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgit2 →
FAQ
libgit2 is an open-source library that provides a low-level API for interacting with Git repositories. It is used by many applications and frameworks to implement Git functionality.
The vulnerability allows attackers to spoof servers, potentially leading to unauthorized access, data manipulation, and remote code execution.
Versions before 0.24.6 and 0.25.x before 0.25.1 are affected by this vulnerability.
You can fix this vulnerability by updating libgit2 to version 0.25.1 or later.
A temporary workaround is to disable the HTTP transport in libgit2 and use alternative transport mechanisms like SSH or local file access.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
