thodg/libgit2/CHANGELOG.md

Download

v0.27.1

This is a security release fixing insufficient validation of submodule names (CVE-2018-11235, reported by Etienne Stalmans) and disallows .gitmodules files as symlinks.

While submodule names come from the untrusted “.gitmodules” file, we blindly append the name to “$GIT_DIR/modules” to construct the final path of the submodule repository. In case the name contains e.g. “../“, an adversary would be able to escape your repository and write data at arbitrary paths. In accordance with git, we now enforce some rules for submodule names which will cause libgit2 to ignore these malicious names.

Adding a symlink as .gitmodules into the index from the workdir or checking out such files is not allowed as this can make a Git implementation write outside of the repository and bypass the fsck checks for CVE-2018-11235.

libgit2 is not susceptible to CVE-2018-11233.

v0.27

Changes or improvements

API additions

API removals

Breaking API changes

v0.26

Changes or improvements

API additions


Source

Download