New versions of git have been announced today: http://lkml.iu.edu/hypermail/linux/kernel/1805.3/05909.html Version 2.13.7 fixes two security issues.
Status comment: (none) => Fixed upstream in 2.13.7
Assigning to our registered git maintainer.
CC: (none) => marja11Assignee: bugsquad => shlomif
(In reply to Marja Van Waes from comment #1) > Assigning to our registered git maintainer. thanks! I submitted git-2.13.7-1.mga6 to updates_testing.
Status: NEW => ASSIGNEDAssignee: shlomif => qa-bugs
Advisory: ======================== Updated git packages fix security vulnerabilities: It was possible to trick the code that sanity-checks paths on NTFS into reading random piece of memory (CVE-2018-11233). Submodule "names" come from the untrusted .gitmodules file, but we blindly append them to $GIT_DIR/modules to create our on-disk repo paths. This means you can do bad things by putting "../" into the name. We now enforce some rules for submodule names which will cause Git to ignore these malicious names (CVE-2018-11235). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235 http://lkml.iu.edu/hypermail/linux/kernel/1805.3/05909.html ======================== Updated packages in core/updates_testing: ======================== git-2.13.7-1.mga6 git-core-2.13.7-1.mga6 gitk-2.13.7-1.mga6 libgit-devel-2.13.7-1.mga6 git-svn-2.13.7-1.mga6 git-cvs-2.13.7-1.mga6 git-arch-2.13.7-1.mga6 git-email-2.13.7-1.mga6 perl-Git-2.13.7-1.mga6 perl-Git-SVN-2.13.7-1.mga6 git-core-oldies-2.13.7-1.mga6 gitweb-2.13.7-1.mga6 git-prompt-2.13.7-1.mga6 from git-2.13.7-1.mga6.src.rpm
Installed and tested without issues. Tests included the usual operations (e.g. commit, diff, status, log, clone, push, pull) in local and remote repositories (e.g. ssh, https). $ uname -a Linux marte 4.14.44-desktop-2.mga6 #1 SMP Mon May 28 22:35:45 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux $ rpm -qa | egrep '^git|^lib(64)?git' | sort git-2.13.7-1.mga6 git-arch-2.13.7-1.mga6 git-core-2.13.7-1.mga6 git-core-oldies-2.13.7-1.mga6 git-cvs-2.13.7-1.mga6 git-email-2.13.7-1.mga6 gitk-2.13.7-1.mga6 git-prompt-2.13.7-1.mga6 git-svn-2.13.7-1.mga6 lib64git2_25-0.25.0-1.mga6
CC: (none) => mageia
Whiteboard: (none) => MGA6-64-OK
Keywords: (none) => advisory, validated_updateCC: (none) => tmb, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0267.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED