{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "git2",
        "purl": "pkg:cargo/git2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.16.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "By default, when accessing an ssh repository\n(ie via an `ssh:` git repository url)\nthe git2 Rust package does not do any host key checking.\n\nAdditionally,\nthe provided API is not sufficient for a an application\nto do meaningful checking itself.\n\n## Impact\n\nWhen connecting to an ssh repository,\nand when an attacker can redirect the connection\n(performing a malice-in-the-middle attack)\nan affected application might:\n\n * Receive git objects and branches controlled by the attacker,\n   exposing the local system (and whatever happens next)\n   to malicious data.\n   In many circumstances,\n   this could readily lead to privilege escalation.\n\n * Erroneously send git objects to the attacker,\n   rather than to the intended recipient.\n   If the information is not supposed to be public,\n   this would constitute an information leak.\n   Also, since the data doesn\u0027t arrive where intended,\n   it constitutes a denial of service.\n\n## Technical details\n\nThe `git2` Rust package (henceforth, git2-rs)\nunconditionally calls the underlying C `libgit2` functions to set\nan ssh certificate check callback.\nThe Rust package uses this to offer\nthe ability for the application to set a callback to a Rust function.\n\nThe C-level callback function provided by git2-rs 0.15.0 and earlier:\n\n * Always ignores the `is_valid` argument provided by `libgit2`,\n   which indicates whether `libgit2` considers the host key valid\n\n * By default, performs no checks, and then\n   returns code `0`,\n   indicating to `libgit2` to override `libgit2`\u0027s determination\n   and treat the host key as valid.\n\n * Provides only limited APIs to the application\n   for examining the supplied host key,\n   and doesn\u0027t tell the application\n   whether `libgit2`\u0027s checks succeeded,\n   so it is difficult for the application cannot work around the problem.\n\n## Resolution\n\nUpgrade to git2-rs 0.16.x.\n\nThe default behaviour in 0.16.x is to\nhonour `libgit2`\u0027s validity determination.\n\nNote that adding this previously skipped check\nmay cause existing setups to stop working.\n\n## Relationship to CVE-2022-46176\n\nThis bug manifested in cargo where it was assigned CVE-2022-46176.\n\nThe same bug exists in other applications which use\naffected versions of git2-rs\nunless they never try to access git repositories with `ssh:` urls.",
  "id": "RUSTSEC-2023-0002",
  "modified": "2023-02-09T03:11:29Z",
  "published": "2023-01-12T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/git2"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2023-0002.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-lang/git2-rs/pull/909"
    },
    {
      "type": "WEB",
      "url": "https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "git2 Rust package suppresses ssh host key checking",
  "withdrawn": "2023-01-13T12:00:00Z"
}