Subject: CVS commit: pkgsrc/devel/libgit2
From: Thomas Klausner
Date: 2018-06-05 20:48:23
Message id: 20180605184823.29F2FFBEC@cvs.NetBSD.org

Log Message:
libgit2: update to 0.27.1.

v0.27.1
---------

This is a security release fixing insufficient validation of submodule names
(CVE-2018-11235, reported by Etienne Stalmans) and disallows `.gitmodules` files
as symlinks.

While submodule names come from the untrusted ".gitmodules" file, we \ 
blindly
append the name to "$GIT_DIR/modules" to construct the final path of the
submodule repository. In case the name contains e.g. "../", an \ 
adversary would
be able to escape your repository and write data at arbitrary paths. In
accordance with git, we now enforce some rules for submodule names which will
cause libgit2 to ignore these malicious names.

Adding a symlink as `.gitmodules` into the index from the workdir or checking
out such files is not allowed as this can make a Git implementation write
outside of the repository and bypass the `fsck` checks for CVE-2018-11235.

libgit2 is not susceptible to CVE-2018-11233.

Files:
RevisionActionfile
1.26modifypkgsrc/devel/libgit2/Makefile
1.12modifypkgsrc/devel/libgit2/distinfo