Vulnerabilities

RUSTSEC-2023-0003

git2 does not verify SSH keys by default

The git2 and libgit2-sys crates are Rust wrappers around the
libgit2 C library. It was discovered that libgit2 1.5.0
and below did not verify SSH host keys when establishing an SSH connection,
exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this
vulnerability. The following versions of the libgit2-sys Rust crate have been
released:

• libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
• libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only
bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions
are used, but contains no code changes: if you update the libgit2-sys version
there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

RUSTSEC-2024-0013

Memory corruption, denial of service, and arbitrary code execution in libgit2

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

• The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
• The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
• The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.