Date: Wed, 16 Mar 2016 07:34:39 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com>, lael.cellier@...oste.net Cc: website@...se.com Subject: Re: Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315) One thing to keep in mind, once the source code is updated publicly the cat is usually out of the bag (people that read the code commit can understand the security implications typically). So as far as I'm concerned that while inconvenient, what you did isn't really all that wrong (ideally git upstream should have notified distros with a heads up, but again, that's an optional step). If you need help handling a vulnerability/coordinating the embargo/etc you can reach out to Red Hat and we can at least point you in the right direction, if not directly help ourselves (e.g. if we ship it we're more than happy to help!), secalert@...hat.com for that. On Wed, Mar 16, 2016 at 4:47 AM, Laël Cellier <lael.cellier@...oste.net> wrote: > Oh………………………… Big mistake. I might advertised too soon. > > I saw changes were pushed in master, so I thought the next version (which > was 2.7.1) would be the one which will include the fix. > > But as pointed out on > https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions > including the fixes were released yet, and even 2.7.3 still include > path_name(). I didn’t checked the code (Sorrrry). > > > So the only way to fix it is to draw your compilers and compile the > current master branch at https://git.kernel.org/cgit/git/git.git/. > > Or do like github did by using the patches at > http://thread.gmane.org/gmane.comp.version-control.git/286253 and > http://thread.gmane.org/gmane.comp.version-control.git/286008 > > > I’m really sorry… > -- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.