SB2023012216 - MitM attack in libgit2

Description

This security bulletin contains information about 1 security vulnerability.

1) Configuration (CVE-ID: CVE-2023-22742)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing certificate validation in libgit2, when compiled using the optional, included libssh2 backend. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack.

Remediation

Install update from vendor's website.

References

• https://github.com/libgit2/libgit2/releases/tag/v1.4.5
• https://github.com/libgit2/libgit2/releases/tag/v1.5.1
• https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq