From: Luca Ceresoli <luca.ceresoli@bootlin.com>
To: "Lee Chee Yang" <chee.yang.lee@intel.com>
Cc: openembedded-core@lists.openembedded.org
Subject: Re: [OE-core] [patch][master][langdale] libgit2: upgrade to 1.5.1
Date: Thu, 9 Feb 2023 22:32:11 +0100 [thread overview]
Message-ID: <20230209223211.2ecf3ab6@booty> (raw)
In-Reply-To: <20230209130229.3224043-1-chee.yang.lee@intel.com>
Hello Lee Chee,
On Thu, 9 Feb 2023 21:02:29 +0800
"Lee Chee Yang" <chee.yang.lee@intel.com> wrote:
> From: Chee Yang Lee <chee.yang.lee@intel.com>
>
> This is a security release to address CVE-2023-22742: when compiled
> using the optional, included libssh2 backend, libgit2 fails to verify
> SSH keys by default.
>
> When using an SSH remote with the optional, included libssh2 backend,
> libgit2 does not perform certificate checking by default. Prior versions
> of libgit2 require the caller to set the `certificate_check` field of
> libgit2's `git_remote_callbacks` structure - if a certificate check
> callback is not set, libgit2 does not perform any certificate checking.
> This means that by default - without configuring a certificate check
> callback, clients will not perform validation on the server SSH keys and
> may be subject to a man-in-the-middle attack.
>
> Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
A patch doing this same upgrade has been sent yesterday by Alex Kanavin
and is already in master.
--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
prev parent reply other threads:[~2023-02-09 21:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-09 13:02 [patch][master][langdale] libgit2: upgrade to 1.5.1 chee.yang.lee
2023-02-09 21:32 ` Luca Ceresoli [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230209223211.2ecf3ab6@booty \
--to=luca.ceresoli@bootlin.com \
--cc=chee.yang.lee@intel.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.