Bug 544104 – <dev-python/dulwich-0.9.9: Buffer overflow (CVE-2015-0838)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Kristian Fiskerstrand (RETIRED) 2015-03-22 14:29:02 UTC]

From ${URL}: 
Ivan Fratric of the Google Security Team has found a buffer overflow
in the C implementation of the apply_delta() function in Dulwich. This
function is used when accessing Git objects in pack files. Any
Git server or client based on Dulwich that handles untrusted pack
files is very likely to be vulnerable.

This issue has been assigned CVE-2015-0838.

I have attached patches against current HEAD and 0.9.8.
Dulwich 0.9.9 has been released with just this patch.

Tarball available here:
https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz

GPG signature:
https://pypi.python.org/packages/source/d/dulwich/dulwich-0.9.9.tar.gz.asc

Cheers,

Jelmer

[Comment 1 Justin Lecher (RETIRED) 2015-03-22 15:31:25 UTC]

+*dulwich-0.10.0 (22 Mar 2015)
+*dulwich-0.9.9 (22 Mar 2015)
+
+  22 Mar 2015; Justin Lecher <[e-mail]> +dulwich-0.10.0.ebuild,
+  +dulwich-0.9.9.ebuild, -dulwich-0.9.4.ebuild, -dulwich-0.9.5.ebuild,
+  -dulwich-0.9.8.ebuild:
+  Drop old and bump version which fixes CVE-2015-0838, #544104
+

[Comment 2 Justin Lecher (RETIRED) 2015-03-22 15:31:47 UTC]

@arches please stabilize

dev-python/dulwich-0.9.9

[Comment 3 Agostino Sarubbo 2015-03-24 08:51:57 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2015-03-24 08:52:54 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 5 Justin Lecher (RETIRED) 2015-03-24 09:16:42 UTC]

+  24 Mar 2015; Justin Lecher <[e-mail]> -dulwich-0.9.7.ebuild:
+  Clean up after sec stabilization, bug #544104
+

[Comment 6 Yury German 2015-04-22 18:49:58 UTC]

Arches and Maintainer(s), Thank you for your work.

GLSA Vote: No

[Comment 7 Mikle Kolyada (RETIRED) 2015-05-11 20:04:49 UTC]

GLSA vote: no.

Closing as [noglsa]