Critical Security Flaw in libgit2: Inadequate Certificate Checking in SSH Connections
Summary
UBUNTU-CVE-2023-22742: libgit2 is a cross-platform, linkable library implementation of Git. Affects libgit2 versions 0.19.0-2 – 0.19.0-2ubuntu0.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a cross-platform library that provides a linkable implementation of Git, enabling developers to integrate Git functionalities into their applications. It is widely used for its efficiency and flexibility in handling Git repositories. However, a significant vulnerability has been identified in its handling of SSH connections, where it fails to perform certificate checks by default, exposing users to potential man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises from libgit2's optional libssh2 backend, which does not enforce certificate checking unless explicitly configured. This oversight means that if users do not set the 'certificate_check' field in the 'git_remote_callbacks' structure, libgit2 will not validate server SSH keys. Consequently, this can lead to unauthorized access and data interception, making users susceptible to man-in-the-middle attacks. The vulnerability is classified under CVE-2023-22742 and has a CVSS score of 5.3, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, users should manually configure the 'certificate_check' field in the 'git_remote_callbacks' structure to ensure that server SSH keys are validated. This can be done by implementing a certificate check callback function in the application code. For example:
void my_certificate_check_callback(...) {
// Implement certificate validation logic here
}
struct git_remote_callbacks callbacks = {0};
callbacks.certificate_check = my_certificate_check_callback;
Conclusion
The identified vulnerability in libgit2 poses a significant risk to users relying on SSH connections without proper certificate validation. It is crucial to upgrade to the latest patched versions or implement workarounds to ensure the security of applications using this library. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security measures.
See every vulnerability recorded for libgit2 →
FAQ
The vulnerability allows attackers to perform man-in-the-middle attacks by not validating server SSH keys, potentially leading to unauthorized access and data interception.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to v1.4.5 and v1.5.1 are vulnerable due to the lack of default certificate checking in SSH connections.
Yes, you can implement a custom certificate check callback in your application to validate server SSH keys manually.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential security issues.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
