Commit b1d39682764f1535aabdb47ec789575b76aad6df
2018-09-06T13:14:19
CHANGELOG: update for v0.26.7
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e51f762..a4903d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,50 @@
+v0.26.7
+-------
+
+This is a security release fixing the following list of issues:
+
+- Submodule URLs and paths with a leading "-" are now ignored.
+ This is due to the recently discovered CVE-2018-17456, which
+ can lead to arbitrary code execution in upstream git. While
+ libgit2 itself is not vulnerable, it can be used to inject
+ options in an implementation which performs a recursive clone
+ by executing an external command.
+
+- When running repack while doing repo writes,
+ `packfile_load__cb()` could see some temporary files in the
+ directory that were bigger than the usual, and makes `memcmp`
+ overflow on the `p->pack_name` string. This issue was reported
+ and fixed by bisho.
+
+- The configuration file parser used unbounded recursion to parse
+ multiline variables, which could lead to a stack overflow. The
+ issue was reported by the oss-fuzz project, issue 10048 and
+ fixed by Nelson Elhage.
+
+- The fix to the unbounded recursion introduced a memory leak in
+ the config parser. While this leak was never in a public
+ release, the oss-fuzz project reported this as issue 10127. The
+ fix was implemented by Nelson Elhage and Patrick Steinhardt.
+
+- When parsing "ok" packets received via the smart protocol, our
+ parsing code did not correctly verify the bounds of the
+ packets, which could result in a heap-buffer overflow. The
+ issue was reported by the oss-fuzz project, issue 9749 and
+ fixed by Patrick Steinhardt.
+
+- The parsing code for the smart protocol has been tightened in
+ general, fixing heap-buffer overflows when parsing the packet
+ type as well as for "ACK" and "unpack" packets. The issue was
+ discovered and fixed by Patrick Steinhardt.
+
+- Fixed potential integer overflows on platforms with 16 bit
+ integers when parsing packets for the smart protocol. The issue
+ was discovered and fixed by Patrick Steinhardt.
+
+- Fixed potential NULL pointer dereference when parsing
+ configuration files which have "include.path" statements
+ without a value.
+
v0.26.6
-------