Man-in-the-Middle Vulnerability in libgit2 HTTP Transport
CVE-2016-10130

5.9MEDIUM

Key Information:

Vendor

Libgit2 Project

Status
Libgit2
Vendor
CVE Published:
24 March 2017

What is CVE-2016-10130?

The http_connect function in libgit2 versions prior to 0.24.6 and 0.25.x before 0.25.1 is susceptible to man-in-the-middle attacks. This vulnerability can potentially allow attackers to spoof servers by manipulating the error variable, leading to unauthorized access and data exposure. Users of affected versions are advised to update to the latest versions to mitigate this security risk.

References

https://libgit2.github.com/security/
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2017/01/10/5
mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2017/01/11/6
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.