Skip to content

[AutoPR- Security] Patch libgit2 for CVE-2026-53587, CVE-2026-53586, CVE-2026-53585, CVE-2026-53584, CVE-2026-53583 [HIGH] #18548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 2 commits into
base: fasttrack/3.0
Choose a base branch
from
Open

[AutoPR- Security] Patch libgit2 for CVE-2026-53587, CVE-2026-53586, CVE-2026-53585, CVE-2026-53584, CVE-2026-53583 [HIGH] #18548

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ac6521
Patch libgit2 for CVE-2026-53587, CVE-2026-53586, CVE-2026-53585, CVE…
azurelinux-security Aug 21, 2026
052790b
libgit2: fix CVE-2026-53585 backport
Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions SPECS/libgit2/CVE-2026-53583.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
From f8a22238ad56fd5458aa9e4ce840ba6169870e1a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 1 Jun 2026 10:41:21 +0100
Subject: [PATCH] Fix inverted IP SubjectAltName comparison in OpenSSL backend

The verify_server_cert() function in the OpenSSL TLS backend incorrectly
uses !!memcmp() to compare IP SubjectAltName entries. Since memcmp()
returns 0 for matching buffers and non-zero for mismatches, the !!
operator inverts the logic: matching IPs result in matched=0 (rejected)
while mismatched IPs result in matched=1 (accepted). This allows a
MITM attacker with a valid CA-signed certificate containing any IP SAN
to bypass hostname verification for IP-literal HTTPS URLs.

Reported-by: Pavel Kohout, Aisle Research, www.aisle.com
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d.patch
---
src/libgit2/streams/openssl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/libgit2/streams/openssl.c b/src/libgit2/streams/openssl.c
index 9db911e..3a10e4a 100644
--- a/src/libgit2/streams/openssl.c
+++ b/src/libgit2/streams/openssl.c
@@ -374,6 +374,7 @@ static int verify_server_cert(SSL *ssl, const char *host)
struct in6_addr addr6;
struct in_addr addr4;
void *addr = NULL;
+ size_t addrlen = 0;
int i = -1, j, error = 0;

if (SSL_get_verify_result(ssl) != X509_V_OK) {
@@ -385,10 +386,12 @@ static int verify_server_cert(SSL *ssl, const char *host)
if (p_inet_pton(AF_INET, host, &addr4)) {
type = GEN_IPADD;
addr = &addr4;
+ addrlen = sizeof(addr4);
} else {
if (p_inet_pton(AF_INET6, host, &addr6)) {
type = GEN_IPADD;
addr = &addr6;
+ addrlen = sizeof(addr6);
}
}

@@ -423,7 +426,7 @@ static int verify_server_cert(SSL *ssl, const char *host)
matched = !!check_host_name(host, name);
} else if (type == GEN_IPADD) {
/* Here name isn't so much a name but a binary representation of the IP */
- matched = addr && !!memcmp(name, addr, namelen);
+ matched = (addr && namelen == addrlen && memcmp(name, addr, namelen) == 0);
}
}
}
--
2.45.4

Loading
Loading