Received: by mail.netbsd.org (Postfix, from userid 605) id B441684E3D; Fri, 5 Oct 2018 17:48:22 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id BE6B984D7A for ; Fri, 5 Oct 2018 17:48:21 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id kFmbi_LEQEHN for ; Fri, 5 Oct 2018 17:48:21 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id E5ABD84D54 for ; Fri, 5 Oct 2018 17:48:20 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id DEBC7FBEE; Fri, 5 Oct 2018 17:48:20 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1538761700197290" MIME-Version: 1.0 Date: Fri, 5 Oct 2018 17:48:20 +0000 From: "Maya Rashish" Subject: CVS commit: pkgsrc/devel To: pkgsrc-changes@NetBSD.org Reply-To: maya@netbsd.org X-Mailer: log_accum Message-Id: <20181005174820.DEBC7FBEE@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1538761700197290 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: maya Date: Fri Oct 5 17:48:20 UTC 2018 Modified Files: pkgsrc/devel/git: Makefile.version pkgsrc/devel/git-base: distinfo Log Message: Git: update to 2.19.1 These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1). Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively. To generate a diff of this commit: cvs rdiff -u -r1.73 -r1.74 pkgsrc/devel/git/Makefile.version cvs rdiff -u -r1.83 -r1.84 pkgsrc/devel/git-base/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1538761700197290 Content-Disposition: inline Content-Length: 1822 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/devel/git/Makefile.version diff -u pkgsrc/devel/git/Makefile.version:1.73 pkgsrc/devel/git/Makefile.version:1.74 --- pkgsrc/devel/git/Makefile.version:1.73 Thu Sep 13 10:56:42 2018 +++ pkgsrc/devel/git/Makefile.version Fri Oct 5 17:48:20 2018 @@ -1,7 +1,7 @@ -# $NetBSD: Makefile.version,v 1.73 2018/09/13 10:56:42 adam Exp $ +# $NetBSD: Makefile.version,v 1.74 2018/10/05 17:48:20 maya Exp $ # # used by devel/git/Makefile.common # used by devel/git-cvs/Makefile # used by devel/git-svn/Makefile -GIT_VERSION= 2.19.0 +GIT_VERSION= 2.19.1 Index: pkgsrc/devel/git-base/distinfo diff -u pkgsrc/devel/git-base/distinfo:1.83 pkgsrc/devel/git-base/distinfo:1.84 --- pkgsrc/devel/git-base/distinfo:1.83 Thu Sep 13 10:56:42 2018 +++ pkgsrc/devel/git-base/distinfo Fri Oct 5 17:48:20 2018 @@ -1,9 +1,9 @@ -$NetBSD: distinfo,v 1.83 2018/09/13 10:56:42 adam Exp $ +$NetBSD: distinfo,v 1.84 2018/10/05 17:48:20 maya Exp $ -SHA1 (git-2.19.0.tar.xz) = 17f92df56588c58d2ebaacc5a47f677c8d8e7c61 -RMD160 (git-2.19.0.tar.xz) = 7beb63b801939650f5b8b08b6efd6d3c3235dc81 -SHA512 (git-2.19.0.tar.xz) = 305e51f8e22d96847fcdf4169340795aacaf5f4c5b8052cda860a668059d9ef35bb2840c278b7207f3b9f0e1c32915719649edc20bd3cd33b53e97a06159ceac -Size (git-2.19.0.tar.xz) = 5227124 bytes +SHA1 (git-2.19.1.tar.xz) = b61b1bdaf0e695a9c76e9a7994bff0c6026ca540 +RMD160 (git-2.19.1.tar.xz) = f03b87ab8ad24e9c7ceb346f25da1ea6621f59e4 +SHA512 (git-2.19.1.tar.xz) = a1bc1032b1de9eb9ea8b7c385cd009f64247e13066e0a91e9682e35400ded05f88c23b523cca4782f57544060d6ba0f9d3bec944399cda5771a4945c38bb9b98 +Size (git-2.19.1.tar.xz) = 5227908 bytes SHA1 (patch-Makefile) = 41955729837095abc055850751cce19023e7a2d1 SHA1 (patch-ac) = e5d2112d158fe493a89b244a10d2e4b998a23d98 SHA1 (patch-af) = 06460f220b4703a1ff98809006ec1aed5017bb23 --_----------=_1538761700197290--