Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 23 Nov 2015 13:13:08 +0100
From: Jan Rusnacko <jrusnack@...hat.com>
To: oss-security@...ts.openwall.com,
        Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: CVE Request: git

On 10/06/2015 05:56 AM, Seth Arnold wrote:
> Hello MITRE, all,
> 
> The git project announced v2.6.1 https://lkml.org/lkml/2015/10/5/683
> and included the following text:
> 
> 	 * Some protocols (like git-remote-ext) can execute arbitrary code
> 	   found in the URL. The URLs that submodules use may come
> 	   from arbitrary sources (e.g., .gitmodules files in a remote
> 	   repository), and can hurt those who blindly enable recursive
> 	   fetch. Restrict the allowed protocols to well known and
> 	   safe ones.
> 
> The following commits appear to implement the restrictions:
> 
> https://kernel.googlesource.com/pub/scm/git/git/+/a5adaced2e13c135d5d9cc65be9eb95aa3bacedf%5E%21/
> https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021%5E%21/
> https://kernel.googlesource.com/pub/scm/git/git/+/5088d3b38775f8ac12d7f77636775b16059b67ef%5E%21/
> https://kernel.googlesource.com/pub/scm/git/git/+/f4113cac0c88b4f36ee6f3abf3218034440a68e3%5E%21/
> https://kernel.googlesource.com/pub/scm/git/git/+/b258116462399b318c86165c61a5c7123043cfd4%5E%21/
> 
> I do not know if this is exhaustive.
> 
> The announcement also mentions some int-based overflows but does not
> describe any situations that would allow crossing privilege boundaries.
> 
> Please assign CVEs as appropriate.

Can CVE be assigned to this vulnerability please?

-- 
Jan Rusnacko, Red Hat Product Security

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.