Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 6 Nov 2023 23:20:08 +0100
From: Pietro Albini <>
To: Solar Designer <>,
Subject: Re: CVE-2022-46176: Cargo does not check SSH host keys

Hello all,

 > I think the libgit2 issue was never brought to oss-security, so I am
 > passing its mention to here now.  Also per that thread, CVE-2022-46176
 > is only for the Cargo issue.  libgit2 was supposed to get its own CVE,
 > but no one in the thread knew whether they actually did.

The Rust project was in contact with the libgit2 maintainers to coordinate the 
two disclosures (that's why we mentioned it in the distros email), but some 
miscommunication happened and the libgit2 side of the advisory didn't end up 
being posted here by its maintainers.

libgit2's advisory is available here, and has CVE-2023-22742 assigned to it:

 > I don't know whether libgit2 was actually fixed on that date as planned.

The libgit2 advisory and fix ended up being published later, on January 20th.

Rust Security Response WG

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.