From e873f774695bbbcc71bdb0acba9fe338f3d2cdbd Mon Sep 17 00:00:00 2001 From: Todd Zullinger Date: Fri, 5 Oct 2018 15:18:02 -0400 Subject: [PATCH] Update to 2.14.5 (CVE-2018-17456) From the upstream release announcement: These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". In addition to fixing the security issue for the user running "clone", the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can be used to detect such malicious repository content when fetching or accepting a push. See "transfer.fsckObjects" in git-config(1). Credit for finding and fixing this vulnerability goes to joernchen and Jeff King, respectively. References: https://public-inbox.org/git/xmqqy3bcuy3l.fsf@gitster-ct.c.googlers.com/ --- git.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/git.spec b/git.spec index 8d24bfa..2ff3c6c 100644 --- a/git.spec +++ b/git.spec @@ -44,7 +44,7 @@ %endif Name: git -Version: 2.14.4 +Version: 2.14.5 Release: 1%{?dist} Summary: Fast Version Control System License: GPLv2 @@ -753,6 +753,9 @@ rm -rf %{buildroot} # No files for you! %changelog +* Fri Oct 05 2018 Todd Zullinger - 2.14.5-1 +- Update to 2.14.5 (CVE-2018-17456) + * Tue May 29 2018 Todd Zullinger - 2.14.4-1 - Update to 2.14.4 (CVE-2018-11233, CVE-2018-11235) diff --git a/sources b/sources index 7a14dcb..f10aaab 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (git-2.14.4.tar.xz) = ddbc55f37d0a6a297426c666375543254dfe5dc2a5bb6c0a89143b70d1f1f811c121a9c16e7245289e71adb4b1d37e0749ef2c8252c5332485bebe85ccd2a266 -SHA512 (git-2.14.4.tar.sign) = 40bfcb2023aa1d85220cf4d76bb93d717ea3c77f9ad90120ae1fea4474f09030dad0816201e9c59b20922fa454bcefc2d6633dcac77e193966227fc801fb3224 +SHA512 (git-2.14.5.tar.xz) = cd87ed857e0340cb95e7fd8adb19adc1fa51c80134be3b08fc5fb8846f5ef88bacf322d3a576ae35e5df9febfee7d8b337c48a4af7b6c98bcf30c8ce1cfc5308 +SHA512 (git-2.14.5.tar.sign) = 7df316948726f49443c141c8576a2f50f1909cf60d151952d0b1c29ccf1c9490ccdc004aa6c814319712ee7e8b7215846c8fe4a6752bf0a5accf8e8bfd2c5e44