dev-libs/libgit2-0.27.1 version bump solves CVE-2018-11235 and should work with dev-libs/libressl-2.7.3 (unstable/masked) (I have not emerged and tried yet )
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a9b88702436769620b4a8fb0b7fe675b9dc0ea38 commit a9b88702436769620b4a8fb0b7fe675b9dc0ea38 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-05-30 06:09:22 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-05-30 06:38:13 +0000 dev-libs/libgit2: Bump to 0.27.1 Bug: https://bugs.gentoo.org/656874 dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.27.1.ebuild | 80 ++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+)
So, I've bumped it. Now, the problem is that libgit2-glib + gitg still require 0.26*. @gnome, any advice?
I'm not sure offhand what the progress is there, but I suspect the security fix could be easily backported to the 0.26 series in the meantime
Upstream made 0.26.4 release. I'm testing it right now, will merge and stabilize soonish.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=713ebf5541b66ea8db94f775e5b681b338efe37d commit 713ebf5541b66ea8db94f775e5b681b338efe37d Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-06-05 15:23:29 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-06-05 15:27:05 +0000 dev-libs/libgit2: Bump to 0.26.4 (security fix) Bug: https://bugs.gentoo.org/656874 dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.26.4.ebuild | 80 ++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+)
Arch teams, please proceed.
amd64 stable
x86 stable
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=509da37d06f83bcbad61063d536f7dad48671bbe commit 509da37d06f83bcbad61063d536f7dad48671bbe Author: Mart Raudsepp <leio@gentoo.org> AuthorDate: 2018-07-02 10:45:18 +0000 Commit: Mart Raudsepp <leio@gentoo.org> CommitDate: 2018-07-02 10:46:29 +0000 dev-libs/libgit2: remove old with security vulnerabilities Bug: https://bugs.gentoo.org/656874 Package-Manager: Portage-2.3.40, Repoman-2.3.9 dev-libs/libgit2/Manifest | 2 - dev-libs/libgit2/libgit2-0.26.3.ebuild | 80 ---------------------------------- dev-libs/libgit2/libgit2-0.27.0.ebuild | 80 ---------------------------------- 3 files changed, 162 deletions(-)
GLSA Vote: No
