oss-sec mailing list archives
Dulwich security issue
From: Jelmer Vernooij <jelmer () samba org>
Date: Sun, 22 Mar 2015 00:20:22 +0000
Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function in Dulwich. This function is used when accessing Git objects in pack files. Any Git server or client based on Dulwich that handles untrusted pack files is very likely to be vulnerable. This issue has been assigned CVE-2015-0838. I have attached patches against current HEAD and 0.9.8. Dulwich 0.9.9 has been released with just this patch. Tarball available here: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz GPG signature: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz.asc Cheers, Jelmer
Attachment:
dulwich-0.9.9.diff
Description:
Attachment:
dulwich-head.diff
Description:
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Dulwich security issue Jelmer Vernooij (Mar 22)