oss-sec mailing list archives
Re: CVE request -- git
From: Tomas Hoger <thoger () redhat com>
Date: Wed, 21 Jan 2009 09:10:22 +0100
Hi Steven! On Tue, 20 Jan 2009 20:09:45 -0500 (EST) "Steven M. Christey" <coley () linus mitre org> wrote:
CVE-2008-5916 was assigned to the diff.external issue.
Thank you!
I updated the descriptions for CVE-2008-5516 and CVE-2008-5517 based on Tomas' description.
Looks like they got texts mixed up. -5516 was given to git_search issue, and -5517 to git_snapshot and git_object issues (the idea was to use lower id for the issue fixed earlier). Btw, commitdiff links are correct, only texts need swapping. Can you also change "in 1.5.x" to "before 1.5.x" in both descriptions? Wording in our BZ is probably confusing, but versions 1.5.5 and 1.5.6 are the first versions to include the fix, not the vulnerability.
Sebastian - it's not clear to me whether SUSE:SUSE-SR:2009:001 is addressing CVE-2008-5516, CVE-2008-5517, or both.
I've looked into their source rpm, and this is from my previous mail: "They fixed both -5516 (git_search) and -5517 (git_snapshot and git_object) issues using quote_command() (in their git-1.5.2.4-24.4.src.rpm)." http://www.openwall.com/lists/oss-security/2009/01/20/1
Same question to the rPath maintainers...
Their announcement mentions version 1.5.6.6, that should have both issues fixed (and -5916). They'll probably clarify what was their "old" version. HTH -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- CVE request -- git Florian Weimer (Jan 15)
- Re: CVE request -- git Florian Weimer (Jan 19)
- Re: CVE request -- git Tomas Hoger (Jan 20)
- Re: CVE request -- git Sebastian Krahmer (Jan 20)
- Re: CVE request -- git Tomas Hoger (Jan 20)
- Re: CVE request -- git Sebastian Krahmer (Jan 20)
- Re: CVE request -- git Tomas Hoger (Jan 20)
- Re: CVE request -- git Florian Weimer (Jan 19)
- Re: CVE request -- git Tomas Hoger (Jan 21)
- Re: CVE request -- git Steven M. Christey (Jan 22)
- Re: CVE request -- git Tomas Hoger (Jan 23)