Re: Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315)

[Kurt Seifried <kseifried () redhat com>]

One thing to keep in mind, once the source code is updated publicly the cat
is usually out of the bag (people that read the code commit can understand
the security implications typically). So as far as I'm concerned that while
inconvenient, what you did isn't really all that wrong (ideally git
upstream should have notified distros with a heads up, but again, that's an
optional step).

If you need help handling a vulnerability/coordinating the embargo/etc you
can reach out to Red Hat and we can at least point you in the right
direction, if not directly help ourselves (e.g. if we ship it we're more
than happy to help!), secalert () redhat com for that.

On Wed, Mar 16, 2016 at 4:47 AM, Laël Cellier <lael.cellier () laposte net>
wrote:

> Oh………………………… Big mistake. I might advertised too soon.
>
> I saw changes were pushed in master, so I thought the next version (which
> was 2.7.1) would be the one which will include the fix.
>
> But as pointed out on
> https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions
> including the fixes were released yet, and even 2.7.3 still include
> path_name(). I didn’t checked the code (Sorrrry).
>
>
> So the only way to fix it is to draw your compilers and compile the
> current master branch at https://git.kernel.org/cgit/git/git.git/.
>
> Or do like github did by using the patches at
> http://thread.gmane.org/gmane.comp.version-control.git/286253 and
> http://thread.gmane.org/gmane.comp.version-control.git/286008
>
>
> I’m really sorry…



-- 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com