TI-2023-08916 Aliases CVE-2023-22742

libgit2 fails to verify SSH keys by default

LOW 27CWE-347Published 2023-01-20 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00607 49th percentileScored 2026-11-07

Fix Partial libgit2 (libgit2): 1.4.5Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libgit2	libgit2	before 1.4.5; = 1.5.0	1.4.5	Patch available	CNA

libgit2 Vendorlibgit2 Affected before 1.4.5; = 1.5.0 Fixed in 1.4.5 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:libgit2:libgit2::::::::	before 1.4.5	Vulnerable	libgit2
cpe:2.3:a:libgit2:libgit2:1.5.0:::::::*	1.5.0	Vulnerable	libgit2

cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* Versions before 1.4.5 Vulnerable ·libgit2
cpe:2.3:a:libgit2:libgit2:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·libgit2

Remediation

Fix · CNA libgit2 (libgit2) Fixed in 1.4.5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope

Not affected: 2 products

Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2023-22742

References

Patch 2

Advisory 4

Other 1

http://www.openwall.com/lists/oss-security/2023/11/06/5

TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
TI-2024-16198 libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` CVSS 3.1CRITICAL 9.8
TI-2020-09811 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
TI-2020-09810 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
TI-2018-11055 In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a… CVSS 3.1HIGH 7.5
TI-2018-07700 Out-of-bounds read in libgit2 CVSS 3.1HIGH 8.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences