CVE catalog

CVE-2023-22742

libgit2: CVE-2023-22742

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.58% · Oct 25, 2026

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibgit2sid1.9.7+ds-1fixed
Debianlibgit2forky1.9.7+ds-1fixed
Debianlibgit2trixie1.9.0+ds-2+deb13u1fixed
Debianlibgit2trixie-security1.9.0+ds-2+deb13u1fixed
Debianlibgit2bookworm1.5.1+ds-1+deb12u1fixed
Debianlibgit2bookworm-security1.5.1+ds-1+deb12u2fixed
Crates.Iolibgit2-sysNot reported0.13.5fixed
Crates.Iogit2Not reported0.16.1fixed
Ubuntulibgit2pro0.25.1+really0.24.6-1vulnerable
Ubuntulibgit2pro0.26.0+dfsg.1-1.1vulnerable
Ubuntulibgit2pro0.26.0+dfsg.1-1.1build1vulnerable
Ubuntulibgit2pro0.26.0+dfsg.1-1.1ubuntu0.2vulnerable
Ubuntulibgit2pro0.26.0+dfsg.1-1.1ubuntu0.2+esm1fixed
Ubuntulibgit220.040.27.7+dfsg.1-0.2build1vulnerable
Ubuntulibgit220.040.28.3+dfsg.1-1vulnerable
Ubuntulibgit220.040.28.3+dfsg.1-1ubuntu1vulnerable
Ubuntulibgit220.040.28.4+dfsg.1-2vulnerable
Ubuntulibgit220.040.28.4+dfsg.1-2ubuntu0.1fixed
Ubuntulibgit222.041.1.0+dfsg.1-4vulnerable
Ubuntulibgit222.041.1.0+dfsg.1-4.1vulnerable
Ubuntulibgit222.041.1.0+dfsg.1-4.1build1vulnerable
Ubuntulibgit222.041.1.0+dfsg.1-4.1ubuntu0.1fixed
Suselibgit2linux enterprise module for development tools 15 sp41.3.0-150400.3.6.1fixed
Opensuselibgit2leap 15.41.3.0-150400.3.6.1fixed
Opensuselibgit2leap 15.40.26.8-150000.3.18.1fixed
Opensuselibgit2tumbleweed1.5.1-1.1fixed
Suselibgit2manager server module 4.20.28.4-150200.3.6.1fixed
Suselibgit2manager server module 4.30.28.4-150200.3.6.1fixed
Suselibgit2linux enterprise real time 15 sp30.28.4-150200.3.6.1fixed
Opensuselibgit2leap 15.40.28.4-150200.3.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibgit2sourcesid1.5.1+ds-1not yet assignedNot reported[1029368]
Debianlibgit2sourceforky1.5.1+ds-1not yet assignedNot reported[1029368]
Debianlibgit2sourcetrixie1.5.1+ds-1not yet assignedNot reported[1029368]
Debianlibgit2sourcebookworm1.5.1+ds-1not yet assignedNot reported[1029368]
Crates.Iolibgit2-syscrates.ioNot reported0.13.5Not reportedGHSA-M4CH-RFV5-X5G3Not reported
Crates.Iogit2crates.ioNot reported0.16.1Not reportedGHSA-M4CH-RFV5-X5G3Not reported
Ubuntulibgit2debpro0.26.0+dfsg.1-1.1ubuntu0.2+esm1Not reportedUBUNTU-CVE-2023-22742Not reported
Ubuntulibgit2deb20.040.28.4+dfsg.1-2ubuntu0.1Not reportedUBUNTU-CVE-2023-22742Not reported
Ubuntulibgit2deb22.041.1.0+dfsg.1-4.1ubuntu0.1Not reportedUBUNTU-CVE-2023-22742Not reported
Suselibgit2rpmlinux enterprise module for development tools 15 sp41.3.0-150400.3.6.1Not reportedSUSE-SU-2023:1788-1Not reported
Opensuselibgit2rpmleap 15.41.3.0-150400.3.6.1Not reportedSUSE-SU-2023:1788-1Not reported
Opensuselibgit2rpmleap 15.40.26.8-150000.3.18.1Not reportedSUSE-SU-2023:1570-1Not reported
Opensuselibgit2rpmtumbleweed1.5.1-1.1Not reportedOPENSUSE-SU-2024:12632-1Not reported
Suselibgit2rpmmanager server module 4.20.28.4-150200.3.6.1Not reportedSUSE-SU-2023:1909-1Not reported
Suselibgit2rpmmanager server module 4.30.28.4-150200.3.6.1Not reportedSUSE-SU-2023:1909-1Not reported
Suselibgit2rpmlinux enterprise real time 15 sp30.28.4-150200.3.6.1Not reportedSUSE-SU-2023:1909-1Not reported
Opensuselibgit2rpmleap 15.40.28.4-150200.3.6.1Not reportedSUSE-SU-2023:1909-1Not reported

[Debian bug #1029368]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]