GHSA-m4ch-rfv5-x5g3Published

libgit2 fails to verify SSH keys by default

cve-program · CVE-2023-22742

Published

libgit2

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "libgit2",
                    "product": "libgit2",
                    "versions": [
                        {
                            "version": "< 1.4.5",
                            "status": "affected"
                        },
                        {
                            "version": "= 1.5.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2023-26860

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jan 20, 2023, 10:49:06 PM

dateUpdated: Mar 10, 2025, 9:21:08 PM

7 related source bulletins · separate from aliases

openSUSE-SU-2024:12632-1: libgit2-1.5.1-1.1 on GA media

CVE-2023-22742

SUSE-SU-2023:1570-1: Security update for libgit2

CVE-2023-22742

ICSA-24-046-11: Siemens SCALANCE XCM-/XRM-300

CVE-2006-20001 · CVE-2020-10735 · CVE-2021-3445 · CVE-2021-3638 · CVE-2021-4037 · CVE-2021-36369 · CVE-2021-43666 · CVE-2021-45451 · CVE-2022-1015 · CVE-2022-1348 · CVE-2022-2586 · CVE-2022-2880 · CVE-2022-3294 · CVE-2022-3437 · CVE-2022-3515 · CVE-2022-4415 · CVE-2022-4743 · CVE-2022-4744 · CVE-2022-4900 · CVE-2022-4904 · CVE-2022-23471 · CVE-2022-23521 · CVE-2022-24834 · CVE-2022-26691 · CVE-2022-28737 · CVE-2022-28738 · CVE-2022-28739 · CVE-2022-29154 · CVE-2022-29162 · CVE-2022-29187 · CVE-2022-29536 · CVE-2022-32148 · CVE-2022-34903 · CVE-2022-34918 · CVE-2022-36021 · CVE-2022-36227 · CVE-2022-36760 · CVE-2022-37436 · CVE-2022-37454 · CVE-2022-37797 · CVE-2022-38725 · CVE-2022-39189 · CVE-2022-39260 · CVE-2022-41409 · CVE-2022-41556 · CVE-2022-41715 · CVE-2022-41717 · CVE-2022-41723 · CVE-2022-41860 · CVE-2022-41861 · CVE-2022-41862 · CVE-2022-41903 · CVE-2022-42919 · CVE-2022-44370 · CVE-2022-45061 · CVE-2022-45142 · CVE-2022-45919 · CVE-2022-46392 · CVE-2022-46393 · CVE-2022-47629 · CVE-2022-48303 · CVE-2022-48434 · CVE-2023-0160 · CVE-2023-0330 · CVE-2023-0361 · CVE-2023-0494 · CVE-2023-0567 · CVE-2023-0568 · CVE-2023-0590 · CVE-2023-0662 · CVE-2023-1206 · CVE-2023-1380 · CVE-2023-1393 · CVE-2023-1611 · CVE-2023-1670 · CVE-2023-1838 · CVE-2023-1855 · CVE-2023-1859 · CVE-2023-1989 · CVE-2023-1990 · CVE-2023-2002 · CVE-2023-2124 · CVE-2023-2194 · CVE-2023-2269 · CVE-2023-2861 · CVE-2023-2953 · CVE-2023-3006 · CVE-2023-3090 · CVE-2023-3111 · CVE-2023-3141 · CVE-2023-3212 · CVE-2023-3247 · CVE-2023-3268 · CVE-2023-3301 · CVE-2023-3316 · CVE-2023-3390 · CVE-2023-3611 · CVE-2023-3776 · CVE-2023-3863 · CVE-2023-4128 · CVE-2023-4194 · CVE-2023-20593 · CVE-2023-21255 · CVE-2023-22490 · CVE-2023-22742 · CVE-2023-22745 · CVE-2023-23454 · CVE-2023-23931 · CVE-2023-23934 · CVE-2023-23946 · CVE-2023-24538 · CVE-2023-25153 · CVE-2023-25155 · CVE-2023-25193 · CVE-2023-25588 · CVE-2023-25690 · CVE-2023-25727 · CVE-2023-26081 · CVE-2023-26965 · CVE-2023-27522 · CVE-2023-27534 · CVE-2023-27535 · CVE-2023-27536 · CVE-2023-28450 · CVE-2023-28466 · CVE-2023-28486 · CVE-2023-28487 · CVE-2023-29402 · CVE-2023-29404 · CVE-2023-29405 · CVE-2023-29406 · CVE-2023-29409 · CVE-2023-30086 · CVE-2023-30456 · CVE-2023-30772 · CVE-2023-31084 · CVE-2023-31124 · CVE-2023-31130 · CVE-2023-31147 · CVE-2023-31436 · CVE-2023-31489 · CVE-2023-32067 · CVE-2023-32233 · CVE-2023-32573 · CVE-2023-33203 · CVE-2023-34256 · CVE-2023-34872 · CVE-2023-34969 · CVE-2023-35001 · CVE-2023-35788 · CVE-2023-35789 · CVE-2023-35823 · CVE-2023-35824 · CVE-2023-35828 · CVE-2023-36054 · CVE-2023-36617 · CVE-2023-36664 · CVE-2023-37920 · CVE-2023-38559 · CVE-2023-40283

msrc_CVE-2023-22742: libgit2 fails to verify SSH keys by default

CVE-2023-22742

SSA-806742: SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4

SUSE-SU-2023:1788-1: Security update for libgit2

CVE-2023-22742

SUSE-SU-2023:1909-1: Security update for libgit2

CVE-2023-22742

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2023-22742

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-347

Original publisher date fields

published: 2023-01-20T23:15:10.307

lastModified: 2026-06-17T05:36:04.797

2 source CPE criteria · context only

cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*
cpe:2.3:a:libgit2:libgit2:1.5.0:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-m4ch-rfv5-x5g3

Published

libgit2-sys

crates.io

SEMVER · introduced 0.14.0 → fixed 0.14.2

libgit2-sys

crates.io

SEMVER · introduced 0 → fixed 0.13.5

git2

crates.io

SEMVER · introduced 0 → fixed 0.16.1

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2023-0003

Published

libgit2-sys

crates.io

SEMVER · introduced 0.0.0-0 → fixed 0.13.5 → introduced 0.14.0 → fixed 0.14.2

Original source record · Cite this exact observation · Complete original publisher JSON