git2-0.13.18.crate: 1 vulnerabilities (highest severity is: 5.9)

[mend-for-github.aaakk.us.kg]

Vulnerable Library - git2-0.13.18.crate

Bindings to libgit2 for interoperating with git repositories. This library is both threadsafe and memory safe and allows both reading and writing git repositories.

Library home page: https://crates.io/api/v1/crates/git2/0.13.18/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml,/cargo-audit/Cargo.toml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (git2 version)	Remediation Possible**
CVE-2023-22742	Medium	5.9	git2-0.13.18.crate	Direct	git2 - 0.16.1, libgit2-sys - 0.13.5+1.4.5,0.14.2+1.5.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-22742

Vulnerable Library - git2-0.13.18.crate

Bindings to libgit2 for interoperating with git repositories. This library is both threadsafe and memory safe and allows both reading and writing git repositories.

Library home page: https://crates.io/api/v1/crates/git2/0.13.18/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml,/cargo-audit/Cargo.toml

Dependency Hierarchy:

• ❌ git2-0.13.18.crate (Vulnerable Library)

Found in base branch: main

Vulnerability Details

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked.

Publish Date: 2023-01-20

URL: CVE-2023-22742

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m4ch-rfv5-x5g3

Release Date: 2023-01-20

Fix Resolution: git2 - 0.16.1, libgit2-sys - 0.13.5+1.4.5,0.14.2+1.5.1