1 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
Ubuntu warns libgit2 TLS IP certificate checks can enable a machine-in-the-middle attack.
Ubuntu Security Notice USN-8907-1 says libgit2 incorrectly verified IP address SubjectAltName entries during TLS certificate validation. A remote attacker with a CA-trusted certificate could use the flaw for a machine-in-the-middle attack and expose sensitive information. The notice does not name a CVE or report observed exploitation.
Ubuntu warns libgit2 mishandles some SSH repository URLs, possibly allowing command execution.
Ubuntu security notice USN-8809-1 says libgit2 incorrectly handled certain repository URLs when using the SSH transport. Researchers Kazuma Matsumoto and Isabel Mill discovered the issue. Ubuntu warns a remote attacker could possibly use it to execute arbitrary commands. The published text does not include a CVE identifier or report in-the-wild exploitation.