Date: Sun, 22 Mar 2015 00:20:22 +0000 From: Jelmer Vernooij <jelmer@...ba.org> To: dulwich-users@...ts.launchpad.net, oss-security@...ts.openwall.com Cc: jelmer@...gle.com Subject: Dulwich security issue Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function in Dulwich. This function is used when accessing Git objects in pack files. Any Git server or client based on Dulwich that handles untrusted pack files is very likely to be vulnerable. This issue has been assigned CVE-2015-0838. I have attached patches against current HEAD and 0.9.8. Dulwich 0.9.9 has been released with just this patch. Tarball available here: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz GPG signature: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz.asc Cheers, Jelmer View attachment "dulwich-0.9.9.diff" of type "text/x-diff" (2779 bytes) View attachment "dulwich-head.diff" of type "text/x-diff" (2255 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.