Received: by mail.netbsd.org (Postfix, from userid 605) id DE10884D55; Mon, 16 Dec 2019 13:12:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 62EAB84CD3 for ; Mon, 16 Dec 2019 13:12:32 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id SDwn7V324fTx for ; Mon, 16 Dec 2019 13:12:31 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 7C88984C2B for ; Mon, 16 Dec 2019 13:12:31 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 77C06FA97; Mon, 16 Dec 2019 13:12:31 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_157650195126250" MIME-Version: 1.0 Date: Mon, 16 Dec 2019 13:12:31 +0000 From: "Benny Siegert" Subject: CVS commit: [pkgsrc-2019Q3] pkgsrc/devel/libgit2 To: pkgsrc-changes@NetBSD.org Reply-To: bsiegert@netbsd.org X-Mailer: log_accum Message-Id: <20191216131231.77C06FA97@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_157650195126250 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: bsiegert Date: Mon Dec 16 13:12:31 UTC 2019 Modified Files: pkgsrc/devel/libgit2 [pkgsrc-2019Q3]: Makefile distinfo Log Message: Pullup ticket #6102 - requested by nia devel/libgit2: security fix Revisions pulled up: - devel/libgit2/Makefile 1.41 - devel/libgit2/distinfo 1.19 --- Module Name: pkgsrc Committed By: nia Date: Sat Dec 14 02:57:02 UTC 2019 Modified Files: pkgsrc/devel/libgit2: Makefile distinfo Log Message: libgit2: Update to 0.28.4 v0.28.4 -------- This is a security release fixing the following issues: - CVE-2019-1348: the fast-import stream command "feature export-marks=path" allows writing to arbitrary file paths. As libgit2 does not offer any interface for fast-import, it is not susceptible to this vulnerability. - CVE-2019-1349: by using NTFS 8.3 short names, backslashes or alternate filesystreams, it is possible to cause submodules to be written into pre-existing directories during a recursive clone using git. As libgit2 rejects cloning into non-empty directories by default, it is not susceptible to this vulnerability. - CVE-2019-1350: recursive clones may lead to arbitrary remote code executing due to improper quoting of command line arguments. As libgit2 uses libssh2, which does not require us to perform command line parsing, it is not susceptible to this vulnerability. - CVE-2019-1351: Windows provides the ability to substitute drive letters with arbitrary letters, including multi-byte Unicode letters. To fix any potential issues arising from interpreting such paths as relative paths, we have extended detection of DOS drive prefixes to accomodate for such cases. - CVE-2019-1352: by using NTFS-style alternative file streams for the ".git" directory, it is possible to overwrite parts of the repository. While this has been fixed in the past for Windows, the same vulnerability may also exist on other systems that write to NTFS filesystems. We now reject any paths starting with ".git:" on all systems. - CVE-2019-1353: by using NTFS-style 8.3 short names, it was possible to write to the ".git" directory and thus overwrite parts of the repository, leading to possible remote code execution. While this problem was already fixed in the past for Windows, other systems accessing NTFS filesystems are vulnerable to this issue too. We now enable NTFS protecions by default on all systems to fix this attack vector. - CVE-2019-1354: on Windows, backslashes are not a valid part of a filename but are instead interpreted as directory separators. As other platforms allowed to use such paths, it was possible to write such invalid entries into a Git repository and was thus an attack vector to write into the ".git" dierctory. We now reject any entries starting with ".git\" on all systems. - CVE-2019-1387: it is possible to let a submodule's git directory point into a sibling's submodule directory, which may result in overwriting parts of the Git repository and thus lead to arbitrary command execution. As libgit2 doesn't provide any way to do submodule clones natively, it is not susceptible to this vulnerability. Users of libgit2 that have implemented recursive submodule clones manually are encouraged to review their implementation for this vulnerability. To generate a diff of this commit: cvs rdiff -u -r1.39.2.1 -r1.39.2.2 pkgsrc/devel/libgit2/Makefile cvs rdiff -u -r1.17.4.1 -r1.17.4.2 pkgsrc/devel/libgit2/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_157650195126250 Content-Disposition: inline Content-Length: 1685 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/devel/libgit2/Makefile diff -u pkgsrc/devel/libgit2/Makefile:1.39.2.1 pkgsrc/devel/libgit2/Makefile:1.39.2.2 --- pkgsrc/devel/libgit2/Makefile:1.39.2.1 Mon Oct 7 09:14:47 2019 +++ pkgsrc/devel/libgit2/Makefile Mon Dec 16 13:12:31 2019 @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.39.2.1 2019/10/07 09:14:47 bsiegert Exp $ +# $NetBSD: Makefile,v 1.39.2.2 2019/12/16 13:12:31 bsiegert Exp $ -DISTNAME= libgit2-0.28.3 +DISTNAME= libgit2-0.28.4 CATEGORIES= devel MASTER_SITES= ${MASTER_SITE_GITHUB:=libgit2/} GITHUB_TAG= v${PKGVERSION_NOREV} Index: pkgsrc/devel/libgit2/distinfo diff -u pkgsrc/devel/libgit2/distinfo:1.17.4.1 pkgsrc/devel/libgit2/distinfo:1.17.4.2 --- pkgsrc/devel/libgit2/distinfo:1.17.4.1 Mon Oct 7 09:14:47 2019 +++ pkgsrc/devel/libgit2/distinfo Mon Dec 16 13:12:31 2019 @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.17.4.1 2019/10/07 09:14:47 bsiegert Exp $ +$NetBSD: distinfo,v 1.17.4.2 2019/12/16 13:12:31 bsiegert Exp $ -SHA1 (libgit2-0.28.3.tar.gz) = fb3c394b36e17ebb2cea42a2c407e899f90509a9 -RMD160 (libgit2-0.28.3.tar.gz) = 76e988d9229a58ff9f1e39e33a33317cb806f33e -SHA512 (libgit2-0.28.3.tar.gz) = 15444823b7d4885f7b8c3982f8905efc4a75913de016a9b2e0a24d5ce9746e6a549dffd5469036529557feff2ce7ece9328266eb312c80b96091ce0f65ee97ee -Size (libgit2-0.28.3.tar.gz) = 4988580 bytes +SHA1 (libgit2-0.28.4.tar.gz) = bf92f95425703b93db969df32c64c4c331425308 +RMD160 (libgit2-0.28.4.tar.gz) = f50ffce9d910de64e270102f84d28e7c3ae5bfd4 +SHA512 (libgit2-0.28.4.tar.gz) = b81160608003b25d9b922d259ebbbbf941b6bd5100fa1875497c8cd29de320e292fff568c757a7a85b2b3044ddc1cb92c74dbcb13d630d62ecf9a8559b619d15 +Size (libgit2-0.28.4.tar.gz) = 4991720 bytes --_----------=_157650195126250--