-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Fri, 05 Oct 2018 00:41:17 -0700 Source: git Binary: git git-man git-core git-doc git-arch git-cvs git-svn git-mediawiki git-email git-daemon-run git-daemon-sysvinit git-gui gitk git-el gitweb git-all Architecture: source amd64 all Version: 1:2.1.4-2.1+deb8u7 Distribution: jessie-security Urgency: high Maintainer: Gerrit Pape <pape@smarden.org> Changed-By: Jonathan Nieder <jrnieder@gmail.com> Description: git - fast, scalable, distributed revision control system git-all - fast, scalable, distributed revision control system (all subpacka git-arch - fast, scalable, distributed revision control system (arch interop git-core - fast, scalable, distributed revision control system (obsolete) git-cvs - fast, scalable, distributed revision control system (cvs interope git-daemon-run - fast, scalable, distributed revision control system (git-daemon s git-daemon-sysvinit - fast, scalable, distributed revision control system (git-daemon s git-doc - fast, scalable, distributed revision control system (documentatio git-el - fast, scalable, distributed revision control system (emacs suppor git-email - fast, scalable, distributed revision control system (email add-on git-gui - fast, scalable, distributed revision control system (GUI) git-man - fast, scalable, distributed revision control system (manual pages git-mediawiki - fast, scalable, distributed revision control system (MediaWiki in git-svn - fast, scalable, distributed revision control system (svn interope gitk - fast, scalable, distributed revision control system (revision tre gitweb - fast, scalable, distributed revision control system (web interfac Changes: git (1:2.1.4-2.1+deb8u7) jessie-security; urgency=high . * Fix CVE-2018-17456, arbitrary code execution via submodule URLs and paths in .gitmodules file: - submodule: ban submodule urls that start with a dash - submodule: ban submodule paths that start with a dash - submodule: use "--" to signal end of clone options - fsck: detect submodule urls that start with a dash - fsck: detect submodule paths that start with a dash . Thanks to joernchen of Phenoelit for discovering and reporting this vulnerability and to Jeff King for fixing it. . * Correct incomplete shell command injection fix in git cvsimport in 1:2.1.4-2.1+deb8u5. A malicious CVS server could trigger arbitrary code execution by a user running "git cvsimport". - cvsimport: apply shell-quoting regex globally . Thanks to littlelailo for discovering this vulnerability and to Jeff King for fixing it. . * fsck: error out when .gitmodules is a symbolic link, completing the backport of the patch "fsck: complain when .gitmodules is a symlink" in 1:2.1.4-2.1+deb8u6. Thanks to Pavel Cahyna for the report and patch. Checksums-Sha1: 37ef5e2e481de345f9172c9e24a04642917cefb9 2846 git_2.1.4-2.1+deb8u7.dsc 33dd55cebc4f6230e6df72b4a0058d7343ce6eb0 517256 git_2.1.4-2.1+deb8u7.debian.tar.xz 14ea8d64b984ca8d27d82f9e4228a3c634e2cbb6 3709046 git_2.1.4-2.1+deb8u7_amd64.deb 0c00650cbd8a936bd6bf89827cf65cd25f8f8aa8 1410472 git-doc_2.1.4-2.1+deb8u7_all.deb 5551e925733f99bd240172955d2d827616279492 589712 git-arch_2.1.4-2.1+deb8u7_all.deb ffeff74bad5e7767ca6d0159aa226a953c82c12c 639642 git-cvs_2.1.4-2.1+deb8u7_all.deb 97acd1d94f21318b916188ea170bdb163b876cb6 663390 git-svn_2.1.4-2.1+deb8u7_all.deb fac9bcdd81d75e83a4ee453f0c2e090cf3c729ba 592066 git-mediawiki_2.1.4-2.1+deb8u7_all.deb ee1e7dc5949c0b5d05b3faf8e999ee1ab61a2f90 578026 git-daemon-run_2.1.4-2.1+deb8u7_all.deb 26fec92df2fdc55a6544dd1f9adcd6dc0ffc552a 578966 git-daemon-sysvinit_2.1.4-2.1+deb8u7_all.deb 12340c8c40969713359a5bdede163091267a1895 596000 git-email_2.1.4-2.1+deb8u7_all.deb 839e5c67ad2e1e273c6e1a5b4dd097c240d53aac 767588 git-gui_2.1.4-2.1+deb8u7_all.deb 14dfe8bac9b4ffac885c42080c8fbae77c191b96 696048 gitk_2.1.4-2.1+deb8u7_all.deb d71ea2234fa4ba532aff616bb9c47c86b080ba16 580882 gitweb_2.1.4-2.1+deb8u7_all.deb f142a828eb539ffec188f9208292efddb9a2befd 576332 git-all_2.1.4-2.1+deb8u7_all.deb d3480651da746aa95a9f5d9890b20c254d51df38 595960 git-el_2.1.4-2.1+deb8u7_all.deb 90ccafdc008aed825a6dd049ba90587154a76cf8 1268864 git-man_2.1.4-2.1+deb8u7_all.deb 57cfae47abd4951335ec273032d6707945779439 1504 git-core_2.1.4-2.1+deb8u7_all.deb Checksums-Sha256: 016a2def5434cd2b84af9f42c73a0388c17636b998bc04bb230b047c7547a646 2846 git_2.1.4-2.1+deb8u7.dsc f378772b946f89e66b44c9d5b1b1f68a64561f07a1e0e7dbb94a94bbbde44442 517256 git_2.1.4-2.1+deb8u7.debian.tar.xz 383f33b84326b79571a04ce466bfc413f56bb21ed40eba1a106ad1a4c3d585b6 3709046 git_2.1.4-2.1+deb8u7_amd64.deb 6781116924fcaf8c674e362d2366b6300df45e2d3b255d0e2283cebd5a4bc999 1410472 git-doc_2.1.4-2.1+deb8u7_all.deb da6a3b8689bbd533a494433aeba3b0e8315a1d8d845d9fc853aa18c145b9cff2 589712 git-arch_2.1.4-2.1+deb8u7_all.deb 1bac40d298c5e3d954208c98f3c47fe7941335dc6ef838cd2d22f82c53e65055 639642 git-cvs_2.1.4-2.1+deb8u7_all.deb 00da8626b5112d4178ca9acefbe29ae197fe7ab9c53e1cdec3efa16d735cc9d4 663390 git-svn_2.1.4-2.1+deb8u7_all.deb 6b4233ba498cbdb6561671a09d8055b465123e287abb904e690a190548f43a9e 592066 git-mediawiki_2.1.4-2.1+deb8u7_all.deb bae21fa689e49022447041f0f66988d5ca8363b70c43aa06aa92d5095af2f077 578026 git-daemon-run_2.1.4-2.1+deb8u7_all.deb 74f60fe9491f52963b251c88317c26a81176395d7b8ee09a4b1e3173a73a09c7 578966 git-daemon-sysvinit_2.1.4-2.1+deb8u7_all.deb 1c4298c1a3b58c728b32f6809a691937bbe68b311584f792de061a2f13f21f92 596000 git-email_2.1.4-2.1+deb8u7_all.deb ae8875deadb3e8e9b1ed72772a54152f52c62484517123e763f7a326191c150c 767588 git-gui_2.1.4-2.1+deb8u7_all.deb 07be819f412fa246d5c63bf29e4d04eb3bf746331599e082ceedcb83a4f04074 696048 gitk_2.1.4-2.1+deb8u7_all.deb 2e12ad5c6b16f67b9f87481c314b6380f8938750251e9c04e3290b93c8f4fc96 580882 gitweb_2.1.4-2.1+deb8u7_all.deb f8c2f1071494a4407ab5a59f79cedc52282062f042c529dd75d80c069b48d39e 576332 git-all_2.1.4-2.1+deb8u7_all.deb 1d81dfabe6582a80348b0c0e36c468b0b3b9944ebc7509976360f67fb097263a 595960 git-el_2.1.4-2.1+deb8u7_all.deb 604a83dbe3fad8aad5706e7f0382ff7d56398e63734633f153fb2a86ebf6a4aa 1268864 git-man_2.1.4-2.1+deb8u7_all.deb 42397f5f7dbd17050218d47e2b1cf2d928324e75d4487c472c311eebd3203d52 1504 git-core_2.1.4-2.1+deb8u7_all.deb Files: ff10bbf6e17b7c456e2a5d8aa4787960 2846 vcs optional git_2.1.4-2.1+deb8u7.dsc 1249ec4892b3904a01254538e82e167e 517256 vcs optional git_2.1.4-2.1+deb8u7.debian.tar.xz 8503cde7a6efa686464e5285dd3a9633 3709046 vcs optional git_2.1.4-2.1+deb8u7_amd64.deb 9d33bf75b778e4beafd5ed5cde461a93 1410472 doc optional git-doc_2.1.4-2.1+deb8u7_all.deb d068e9eb15e936b9b335a588ace66b83 589712 vcs optional git-arch_2.1.4-2.1+deb8u7_all.deb c49dcebfdb8f43bce9a45848aad82c09 639642 vcs optional git-cvs_2.1.4-2.1+deb8u7_all.deb 225a9cca1e681c372506d3efa27e032d 663390 vcs optional git-svn_2.1.4-2.1+deb8u7_all.deb 2274d98db4edf7ad37fb965c3345b1d5 592066 vcs optional git-mediawiki_2.1.4-2.1+deb8u7_all.deb 38cecde5beae9d4c6af9fdeb0ea6852d 578026 vcs optional git-daemon-run_2.1.4-2.1+deb8u7_all.deb be1e94bb6a68cd3ad772f79c4cb53c69 578966 vcs extra git-daemon-sysvinit_2.1.4-2.1+deb8u7_all.deb 148f13668bf8dd6588be964debd19ac5 596000 vcs optional git-email_2.1.4-2.1+deb8u7_all.deb f1a93d81d9adcc7e39d59fd7a6bb9096 767588 vcs optional git-gui_2.1.4-2.1+deb8u7_all.deb 797489212742ede229fc3a567acc79f4 696048 vcs optional gitk_2.1.4-2.1+deb8u7_all.deb 5352307a91ee3a88ab4ca8b65f44b5c7 580882 vcs optional gitweb_2.1.4-2.1+deb8u7_all.deb 32160a49b3a1556fb5663b95357b6aca 576332 vcs optional git-all_2.1.4-2.1+deb8u7_all.deb d71e7dcc13af6c11d6063de9903644bb 595960 vcs optional git-el_2.1.4-2.1+deb8u7_all.deb 8860ba52192592b375fa5878f0966039 1268864 doc optional git-man_2.1.4-2.1+deb8u7_all.deb 904200d58196d35f1cfc0203d0c50641 1504 vcs optional git-core_2.1.4-2.1+deb8u7_all.deb -----BEGIN PGP SIGNATURE----- iQJHBAEBCAAxFiEEUh5Y8X6W1xKqD/EC38Zx7rMz+iUFAlu3ICkTHGpybmllZGVy QGdtYWlsLmNvbQAKCRDfxnHuszP6JfazEACnnznqM+k8B5e38LuTBh+bVgsCA7s7 LbBNFtalOvi3yQRwVp7KtIiPoX32fser4rxvzU2nZPTnlVy1YzJ83xBIhrvxl2uy YWvwqn38T57LoeTMfHgeVJF6Mb59D3JfF8rgbjcmf/5kGftb7r1hr+L55TFq2S4R JpNBZmVOydSpEJaJwQWvMmc7YMZ1rHdKFdIZ90r2qN83CIj+CaTGh4qZBC7UarUH gwNOxAZUmXOiESQIXAGVaKNWoNR0lrYp8w06H6fIYwVGaQFCwc2i07wL59pjVnCq i4elE37qFnIzlXBvT6FxOoE/55KKbbO8/whDO0SSSxX31g7R7J1ZioMktO2r3mbO D0oFvsIFVbD4rQjHvlJ6bLTU3BDaOKcH1LK+bk0uoV4wIzt7HR95UWD6Y3aAGunj 36pm9/EoJgbrTXQ2NTtdIz++Bh/d06K5/BTYRULVLW3u8EqLwY1Cijl8ZlqicuN/ X+KR185NBS49FIzog5VGctYJbpb916ezl2YQ2hU5/nv+M4+7R0L9MAXMPSEaASo/ YwMvdxeRefQ+zMk+Jf6vpCRV/q2WlZeUYXYimKIT0nU0sEo2YM4FeNS6Rg59Q4VP MOXLiBKvb+DyQnO1RJM1dW6+QEavbX8/LlS26hYVup9raUen8biQiC6PlH6PMi48 3Wbi10BoMCD5Aw== =1G02 -----END PGP SIGNATURE-----
