CVS commit: [pkgsrc-2019Q3] pkgsrc/devel/libgit2

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Mon Dec 16 13:12:31 UTC 2019

Modified Files:
        pkgsrc/devel/libgit2 [pkgsrc-2019Q3]: Makefile distinfo

Log Message:
Pullup ticket #6102 - requested by nia
devel/libgit2: security fix

Revisions pulled up:
- devel/libgit2/Makefile                                        1.41
- devel/libgit2/distinfo                                        1.19

---
   Module Name: pkgsrc
   Committed By:        nia
   Date:                Sat Dec 14 02:57:02 UTC 2019

   Modified Files:
        pkgsrc/devel/libgit2: Makefile distinfo

   Log Message:
   libgit2: Update to 0.28.4

   v0.28.4
   --------

   This is a security release fixing the following issues:

   - CVE-2019-1348: the fast-import stream command "feature
     export-marks=path" allows writing to arbitrary file paths. As
     libgit2 does not offer any interface for fast-import, it is not
     susceptible to this vulnerability.

   - CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
     alternate filesystreams, it is possible to cause submodules to
     be written into pre-existing directories during a recursive
     clone using git. As libgit2 rejects cloning into non-empty
     directories by default, it is not susceptible to this
     vulnerability.

   - CVE-2019-1350: recursive clones may lead to arbitrary remote
     code executing due to improper quoting of command line
     arguments. As libgit2 uses libssh2, which does not require us
     to perform command line parsing, it is not susceptible to this
     vulnerability.

   - CVE-2019-1351: Windows provides the ability to substitute
     drive letters with arbitrary letters, including multi-byte
     Unicode letters. To fix any potential issues arising from
     interpreting such paths as relative paths, we have extended
     detection of DOS drive prefixes to accomodate for such cases.

   - CVE-2019-1352: by using NTFS-style alternative file streams for
     the ".git" directory, it is possible to overwrite parts of the
     repository. While this has been fixed in the past for Windows,
     the same vulnerability may also exist on other systems that
     write to NTFS filesystems. We now reject any paths starting
     with ".git:" on all systems.

   - CVE-2019-1353: by using NTFS-style 8.3 short names, it was
     possible to write to the ".git" directory and thus overwrite
     parts of the repository, leading to possible remote code
     execution. While this problem was already fixed in the past for
     Windows, other systems accessing NTFS filesystems are
     vulnerable to this issue too. We now enable NTFS protecions by
     default on all systems to fix this attack vector.

   - CVE-2019-1354: on Windows, backslashes are not a valid part of
     a filename but are instead interpreted as directory separators.
     As other platforms allowed to use such paths, it was possible
     to write such invalid entries into a Git repository and was
     thus an attack vector to write into the ".git" dierctory. We
     now reject any entries starting with ".git\" on all systems.

   - CVE-2019-1387: it is possible to let a submodule's git
     directory point into a sibling's submodule directory, which may
     result in overwriting parts of the Git repository and thus lead
     to arbitrary command execution. As libgit2 doesn't provide any
     way to do submodule clones natively, it is not susceptible to
     this vulnerability. Users of libgit2 that have implemented
     recursive submodule clones manually are encouraged to review
     their implementation for this vulnerability.


To generate a diff of this commit:
cvs rdiff -u -r1.39.2.1 -r1.39.2.2 pkgsrc/devel/libgit2/Makefile
cvs rdiff -u -r1.17.4.1 -r1.17.4.2 pkgsrc/devel/libgit2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libgit2/Makefile
diff -u pkgsrc/devel/libgit2/Makefile:1.39.2.1 pkgsrc/devel/libgit2/Makefile:1.39.2.2
--- pkgsrc/devel/libgit2/Makefile:1.39.2.1      Mon Oct  7 09:14:47 2019
+++ pkgsrc/devel/libgit2/Makefile       Mon Dec 16 13:12:31 2019
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.39.2.1 2019/10/07 09:14:47 bsiegert Exp $
+# $NetBSD: Makefile,v 1.39.2.2 2019/12/16 13:12:31 bsiegert Exp $
 
-DISTNAME=      libgit2-0.28.3
+DISTNAME=      libgit2-0.28.4
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libgit2/distinfo
diff -u pkgsrc/devel/libgit2/distinfo:1.17.4.1 pkgsrc/devel/libgit2/distinfo:1.17.4.2
--- pkgsrc/devel/libgit2/distinfo:1.17.4.1      Mon Oct  7 09:14:47 2019
+++ pkgsrc/devel/libgit2/distinfo       Mon Dec 16 13:12:31 2019
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.17.4.1 2019/10/07 09:14:47 bsiegert Exp $
+$NetBSD: distinfo,v 1.17.4.2 2019/12/16 13:12:31 bsiegert Exp $
 
-SHA1 (libgit2-0.28.3.tar.gz) = fb3c394b36e17ebb2cea42a2c407e899f90509a9
-RMD160 (libgit2-0.28.3.tar.gz) = 76e988d9229a58ff9f1e39e33a33317cb806f33e
-SHA512 (libgit2-0.28.3.tar.gz) = 15444823b7d4885f7b8c3982f8905efc4a75913de016a9b2e0a24d5ce9746e6a549dffd5469036529557feff2ce7ece9328266eb312c80b96091ce0f65ee97ee
-Size (libgit2-0.28.3.tar.gz) = 4988580 bytes
+SHA1 (libgit2-0.28.4.tar.gz) = bf92f95425703b93db969df32c64c4c331425308
+RMD160 (libgit2-0.28.4.tar.gz) = f50ffce9d910de64e270102f84d28e7c3ae5bfd4
+SHA512 (libgit2-0.28.4.tar.gz) = b81160608003b25d9b922d259ebbbbf941b6bd5100fa1875497c8cd29de320e292fff568c757a7a85b2b3044ddc1cb92c74dbcb13d630d62ecf9a8559b619d15
+Size (libgit2-0.28.4.tar.gz) = 4991720 bytes