libgit2 Shell Command Injection Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Affected component
- libgit2 (other)
- Affected versions
- >= v1.9.0, <= v1.9.0 or >= v1.8.2-rc1, <= v1.8.2-rc1 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.0, <= v1.7.0 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.5.0, <= v1.5.0 or >= v1.3.0, <= v1.3.0 or >= v1.4.0, <= v1.4.0 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v0.99.0, <= v0.99.0 or >= v0.28.0-rc1, <= v0.28.0-rc1 or >= v0.28.0, <= v0.28.0 or >= v0.27.0, <= v0.27.0
- Patched version
- Not yet available
An early warning has been issued for a critical shell command injection vulnerability in libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend. This vulnerability allows remote attackers to execute arbitrary commands on an SSH server.
What happened
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend contain a shell command injection vulnerability. This vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(). This enables an attacker to craft a malicious submodule URL in a.gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
The vulnerability is reportedly due to the gen_proto() function in ssh_libssh2.c inserting the repository path directly into a shell command string without escaping special characters. This issue affects libgit2 versions from v0.27.0 through v1.9.0 when built with the libssh2 SSH backend.
What to do about it
- Upgrade libgit2 to a version after v1.9.0.
- Apply the patch if available.
- Monitor the primary sources for updates on the vulnerability and any available patches.
- Review your use of libgit2 and ensure it is not built with the libssh2 SSH backend if possible.
- Consider alternative SSH backends for libgit2 if upgrading is not immediately feasible.
How 0Day would have caught this
libgit2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend.
What should I do right now?
Upgrade libgit2 to a version after v1.9.0 or apply the patch if available. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates on any available patches.
How severe is this vulnerability?
This vulnerability is classified as CRITICAL with a CVSS score of 9.6.