Skip to content

libgit2 v0.27.1
Compare
Choose a tag to compare
@ethomson ethomson released this 29 May 18:08
· 247 commits to maint/v0.27 since this release
v0.27.1
b0d9952
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

This is a security release fixing insufficient validation of submodule names (CVE-2018-11235, reported by Etienne Stalmans).

While submodule names come from the untrusted ".gitmodules" file, we blindly append the name to $GIT_DIR/modules to construct the final path of the submodule repository. In case the name contains e.g. ../, an adversary would be able to escape your repository and write data at arbitrary paths. In accordance with git, we now enforce some rules for submodule names which will cause libgit2 to ignore these malicious names.

libgit2 is not susceptible to CVE-2018-11233.

Assets 2
Loading