-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libgit2-sys | rust | >= 0.14.0, < 0.14.2 | 0.14.2 |
| libgit2-sys | rust | < 0.13.5 | 0.13.5 |
| git2 | rust | < 0.16.1 | 0.16.1 |
Miggo AIRoot Cause AnalysisThe vulnerability originates from the underlying libgit2 C library's behavior, not from specific functions in the Rust wrappers (git2-rs/libgit2-sys). The core issue was that libgit2 versions <1.4.5/1.5.1 didn't perform SSH host key verification by default when using the libssh2 backend. The Rust crates were vulnerable because they bundled these insecure libgit2 versions. The fix involved updating the linked libgit2 version in the build configuration (libgit2-sys/build.rs) rather than modifying Rust code. No specific Rust functions in git2-rs/libgit2-sys were inherently vulnerable - the exposure came from linking against vulnerable C library versions that lacked default host key verification in their SSH transport implementation.