oss-sec mailing list archives

CVE request -- git

From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 15 Jan 2009 20:54:16 +0100

Hi Steve,

could you please assign a CVE for this bug:

| Current gitweb has a possible local privilege escalation bug that allows a
| malicious repository owner to run a command of his choice by specifying
| diff.external configuration variable in his repository and running a
| crafted gitweb query.
|
| [...] Maintenance release v1.6.0.6, v1.5.6.6, v1.5.5.6 and v1.5.4.7
| are already available at k.org (see the announcement for v1.6.0.6 I
| sent out a few minutes ago), and the master branch and others pushed
| out tonight have the same fix. [...]

<http://marc.info/?l=git&m=122975564100860&w=2>

It's from 2008, so maybe it should get a 2008 number.

Thanks,
Florian

Current thread:

CVE request -- git Florian Weimer (Jan 15)
- Re: CVE request -- git Florian Weimer (Jan 19)
  - Re: CVE request -- git Tomas Hoger (Jan 20)
    - Re: CVE request -- git Sebastian Krahmer (Jan 20)
    - Re: CVE request -- git Tomas Hoger (Jan 20)
    - Re: CVE request -- git Sebastian Krahmer (Jan 20)
- Re: CVE request -- git Steven M. Christey (Jan 20)
  - Re: CVE request -- git Tomas Hoger (Jan 21)
    - Re: CVE request -- git Steven M. Christey (Jan 22)
    - Re: CVE request -- git Tomas Hoger (Jan 23)