| Summary: | <dev-python/dulwich-0.9.9: Buffer overflow (CVE-2015-0838) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Kristian Fiskerstrand (RETIRED) <k_f> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | grobian, python |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://seclists.org/oss-sec/2015/q1/932 | ||
| Whiteboard: | B3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
+*dulwich-0.10.0 (22 Mar 2015) +*dulwich-0.9.9 (22 Mar 2015) + + 22 Mar 2015; Justin Lecher <jlec@gentoo.org> +dulwich-0.10.0.ebuild, + +dulwich-0.9.9.ebuild, -dulwich-0.9.4.ebuild, -dulwich-0.9.5.ebuild, + -dulwich-0.9.8.ebuild: + Drop old and bump version which fixes CVE-2015-0838, #544104 + @arches please stabilize dev-python/dulwich-0.9.9 amd64 stable x86 stable. Maintainer(s), please cleanup. Security, please vote. + 24 Mar 2015; Justin Lecher <jlec@gentoo.org> -dulwich-0.9.7.ebuild: + Clean up after sec stabilization, bug #544104 + Arches and Maintainer(s), Thank you for your work. GLSA Vote: No GLSA vote: no. Closing as [noglsa] |
From ${URL}: Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function in Dulwich. This function is used when accessing Git objects in pack files. Any Git server or client based on Dulwich that handles untrusted pack files is very likely to be vulnerable. This issue has been assigned CVE-2015-0838. I have attached patches against current HEAD and 0.9.8. Dulwich 0.9.9 has been released with just this patch. Tarball available here: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz GPG signature: https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz.asc Cheers, Jelmer