PatchTheCVECVE-2023-22742: libgit2 is a cross-platform, linkable library implementation of Git
CVE-2023-22742 is a medium-severity flaw (CVSS 5.3) affecting libgit2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without c
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 52%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2023-01-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-22742?
libgit2: upgrade to 1.4.5. Exact commands for each OS are on this page.
Is CVE-2023-22742 being exploited?
CVE-2023-22742 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-22742 affect?
CVE-2023-22742 affects libgit2. Severity is medium (CVSS 5.3). libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set t
How urgent is CVE-2023-22742?
Priority 30/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2024-24577 HIGH 8.6 UPGRADE libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API
- CVE-2024-24575 HIGH 7.5 UPGRADE libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API
- CVE-2020-12279 CRITICAL 9.8 UPGRADE MITIGATE An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0
- CVE-2020-12278 CRITICAL 9.8 UPGRADE MITIGATE An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0
- CVE-2018-8099 MEDIUM 6.5 UPGRADE MITIGATE Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 be