1421b09816
v0.27.1 --------- This is a security release fixing insufficient validation of submodule names (CVE-2018-11235, reported by Etienne Stalmans) and disallows `.gitmodules` files as symlinks. While submodule names come from the untrusted ".gitmodules" file, we blindly append the name to "$GIT_DIR/modules" to construct the final path of the submodule repository. In case the name contains e.g. "../", an adversary would be able to escape your repository and write data at arbitrary paths. In accordance with git, we now enforce some rules for submodule names which will cause libgit2 to ignore these malicious names. Adding a symlink as `.gitmodules` into the index from the workdir or checking out such files is not allowed as this can make a Git implementation write outside of the repository and bypass the `fsck` checks for CVE-2018-11235. libgit2 is not susceptible to CVE-2018-11233.
6 lines
409 B
Text
6 lines
409 B
Text
$NetBSD: distinfo,v 1.12 2018/06/05 18:48:22 wiz Exp $
|
|
|
|
SHA1 (libgit2-0.27.1.tar.gz) = 2ce74b2dcec76ee0467a26c0cda8153bd29a2ad4
|
|
RMD160 (libgit2-0.27.1.tar.gz) = 46dd959617292cebdbcb031ef49f62acd6e5e62f
|
|
SHA512 (libgit2-0.27.1.tar.gz) = 4cdee4aec0f0c7b36226ee29276b8802d6b59817f95b1357f35225c23a8d6de70242b2dd9a5fb3b765c3242f4ed1848933e20fc24899071d8b443d46c43ce99d
|
|
Size (libgit2-0.27.1.tar.gz) = 4765926 bytes
|