{"id":"CVE-2023-22742","aliases":["GHSA-m4ch-rfv5-x5g3","GHSA-8643-3wh5-rmjq","RUSTSEC-2023-0003"],"title":"git2-rs fails to verify SSH keys by default","summary":"git2-rs fails to verify SSH keys by default","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","vendor":"libgit2-sys","product":"libgit2-sys","ecosystem":"rust","affected":["libgit2-sys >= 0.14.0, < 0.14.2","libgit2-sys < 0.13.5","git2 < 0.16.1"],"patched":["libgit2-sys 0.14.2","libgit2-sys 0.13.5","git2 0.16.1"],"published":"2023-01-20","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:07:22Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m4ch-rfv5-x5g3","references":[{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq"},{"url":"https://github.com/rust-lang/git2-rs/security/advisories/GHSA-m4ch-rfv5-x5g3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22742"},{"url":"https://github.com/rust-lang/git2-rs/commit/87934f87d36753ed702792ec063be7246444a8e1"},{"url":"https://github.com/rust-lang/git2-rs"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0003.html"},{"url":"https://crates.io/crates/libgit2-sys"}],"tags":["osv","rust"],"epss":0.0058,"epssPercentile":0.47507,"ingestedAt":"2026-10-13T11:45:30.161Z","slug":"CVE-2023-22742","body":"## Overview\n\nThe git2 and libgit2-sys crates are Rust wrappers around the [libgit2](https://libgit2.org/) C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.\n\nThe libgit2 team assigned [CVE-2023-22742](https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq) to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:\n\n* libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.\n* libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.\n\nA new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.\n\n[You can learn more about this vulnerability in libgit2's advisory](https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq)\n\n## Affected packages\n\n- `libgit2-sys >= 0.14.0, < 0.14.2`\n- `libgit2-sys < 0.13.5`\n- `git2 < 0.16.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `libgit2-sys 0.14.2`\n- `libgit2-sys 0.13.5`\n- `git2 0.16.1`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222177,"id":"CVE-2023-22742","ts":1792064873862,"field":"cvss","old":null,"new":"6.8"},{"seq":222176,"id":"CVE-2023-22742","ts":1792064873862,"field":"severity","old":"none","new":"medium"}]}