Pullup ticket #5840 - requested by maya
devel/git-base: security update
devel/git: security update

Revisions pulled up:
- devel/git-base/distinfo                                      1.84
- devel/git/Makefile.version                                    1.74

-------------------------------------------------------------------
  Module Name: pkgsrc
  Committed By: maya
  Date: Fri Oct  5 17:48:20 UTC 2018

  Modified Files:
  pkgsrc/devel/git: Makefile.version
  pkgsrc/devel/git-base: distinfo

  Log Message:
  Git: update to 2.19.1

  These releases fix a security flaw (CVE-2018-17456), which allowed an
  attacker to execute arbitrary code by crafting a malicious .gitmodules
  file in a project cloned with --recurse-submodules.

  When running "git clone --recurse-submodules", Git parses the supplied
  .gitmodules file for a URL field and blindly passes it as an argument
  to a "git clone" subprocess.  If the URL field is set to a string that
  begins with a dash, this "git clone" subprocess interprets the URL as
  an option.  This can lead to executing an arbitrary script shipped in
  the superproject as the user who ran "git clone".

  In addition to fixing the security issue for the user running "clone",
  the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
  be used to detect such malicious repository content when fetching or
  accepting a push. See "transfer.fsckObjects" in git-config(1).

  Credit for finding and fixing this vulnerability goes to joernchen
  and Jeff King, respectively.

  To generate a diff of this commit:
  cvs rdiff -u -r1.73 -r1.74 pkgsrc/devel/git/Makefile.version
  cvs rdiff -u -r1.83 -r1.84 pkgsrc/devel/git-base/distinfo

(spz)