{"action":"Upgrade libgit2-sys to 0.13.5 or later.","affected":[{"fixed":"0.13.5","introduced":"0.0.0-0"},{"fixed":"0.14.2","introduced":"0.14.0"}],"component":"libgit2-sys","cve_ids":["CVE-2023-22742"],"ecosystem":"crates.io","epss":0.0058,"exploited":false,"fixed_versions":["0.13.5","0.14.2"],"ghsa_id":"GHSA-8643-3wh5-rmjq","id":"tcs_01M5KF88VHC3TX17EVC4X6MZHH","modified_at":"2026-10-12T18:00:06.112206414Z","published_at":"2023-01-20T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2023-0003","https://crates.io/crates/libgit2-sys","https://rustsec.org/advisories/RUSTSEC-2023-0003.html","https://github.com/rust-lang/git2-rs/commit/87934f87d36753ed702792ec063be7246444a8e1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2023-0003","url":"https://osv.dev/vulnerability/RUSTSEC-2023-0003"}],"summary":"git2 does not verify SSH keys by default"}