CVE-2023-22742

Name	CVE-2023-22742
Description	libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3340-1
Debian Bugs	1029368

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libgit2 (PTS)	bullseye (security), bullseye	1.1.0+dfsg.1-4+deb11u2	fixed
	bookworm, bookworm (security)	1.5.1+ds-1+deb12u1	fixed
	trixie	1.8.2~rc1+ds2-1	fixed
	sid	1.8.4+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libgit2	source	buster	0.27.7+dfsg.1-0.2+deb10u1	DLA-3340-1
libgit2	source	bullseye	1.1.0+dfsg.1-4+deb11u1
libgit2	source	(unstable)	1.5.1+ds-1		1029368

Notes

https://github.com/libgit2/libgit2/commit/cd6f679af401eda1f172402006ef8265f8bd58ea (v1.4.5)
https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56 (v1.5.1)
https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq