According to release notes [1]: | A carefully constructed commit object with a very large number | of parents may lead to potential out-of-bounds writes or | potential denial of service. <0.27.9, and <0.28.3 (of 0.28*) are affected. Since we don't have the 0.27 branch, I'm going to bump to 0.28.3, and we'll probably want to stabilize it ASAP. @gnome, is it ok to stabilize gitg-3.32*? [1] https://github.com/libgit2/libgit2/releases/tag/v0.28.3
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=20523a775ef79244df52d3cfa87dcafca094560d commit 20523a775ef79244df52d3cfa87dcafca094560d Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2019-08-14 20:58:14 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2019-08-14 20:58:41 +0000 dev-libs/libgit2: Bump to 0.28.3 Bug: https://bugs.gentoo.org/692166 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.28.3.ebuild | 72 ++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+)
Arch teams, please stabilize.
x86 stable
arm64 stable
amd64 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a23e5ff54b17576fb7eb8a2f91257940d00342ec commit a23e5ff54b17576fb7eb8a2f91257940d00342ec Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2019-08-19 04:23:54 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2019-08-19 04:28:41 +0000 dev-libs/libgit2: Drop old Bug: https://bugs.gentoo.org/692166 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-libs/libgit2/Manifest | 2 - ...libgit2-0.26.8-disable-oom-tests-on-32bit.patch | 64 ----------------- dev-libs/libgit2/libgit2-0.26.8.ebuild | 82 ---------------------- dev-libs/libgit2/libgit2-0.28.2.ebuild | 72 ------------------- dev-libs/libgit2/metadata.xml | 2 - 5 files changed, 222 deletions(-)
