[pkgsrc/pkgsrc-2018Q3]: pkgsrc/devel Pullup ticket #5840 - requested by maya

[spz <spz%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/a0a6b4b784ea
branches:  pkgsrc-2018Q3
changeset: 408335:a0a6b4b784ea
user:      spz <spz%pkgsrc.org@localhost>
date:      Sat Oct 06 12:03:41 2018 +0000

description:
Pullup ticket #5840 - requested by maya
devel/git-base: security update
devel/git: security update

Revisions pulled up:
- devel/git-base/distinfo                                       1.84
- devel/git/Makefile.version                                    1.74

-------------------------------------------------------------------
   Module Name: pkgsrc
   Committed By:        maya
   Date:                Fri Oct  5 17:48:20 UTC 2018

   Modified Files:
        pkgsrc/devel/git: Makefile.version
        pkgsrc/devel/git-base: distinfo

   Log Message:
   Git: update to 2.19.1

   These releases fix a security flaw (CVE-2018-17456), which allowed an
   attacker to execute arbitrary code by crafting a malicious .gitmodules
   file in a project cloned with --recurse-submodules.

   When running "git clone --recurse-submodules", Git parses the supplied
   .gitmodules file for a URL field and blindly passes it as an argument
   to a "git clone" subprocess.  If the URL field is set to a string that
   begins with a dash, this "git clone" subprocess interprets the URL as
   an option.  This can lead to executing an arbitrary script shipped in
   the superproject as the user who ran "git clone".

   In addition to fixing the security issue for the user running "clone",
   the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
   be used to detect such malicious repository content when fetching or
   accepting a push. See "transfer.fsckObjects" in git-config(1).

   Credit for finding and fixing this vulnerability goes to joernchen
   and Jeff King, respectively.


   To generate a diff of this commit:
   cvs rdiff -u -r1.73 -r1.74 pkgsrc/devel/git/Makefile.version
   cvs rdiff -u -r1.83 -r1.84 pkgsrc/devel/git-base/distinfo

diffstat:

 devel/git-base/distinfo    |  10 +++++-----
 devel/git/Makefile.version |   4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (31 lines):

diff -r ba344db8db9c -r a0a6b4b784ea devel/git-base/distinfo
--- a/devel/git-base/distinfo   Sun Sep 30 18:42:44 2018 +0000
+++ b/devel/git-base/distinfo   Sat Oct 06 12:03:41 2018 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.83 2018/09/13 10:56:42 adam Exp $
+$NetBSD: distinfo,v 1.83.2.1 2018/10/06 12:03:41 spz Exp $
 
-SHA1 (git-2.19.0.tar.xz) = 17f92df56588c58d2ebaacc5a47f677c8d8e7c61
-RMD160 (git-2.19.0.tar.xz) = 7beb63b801939650f5b8b08b6efd6d3c3235dc81
-SHA512 (git-2.19.0.tar.xz) = 305e51f8e22d96847fcdf4169340795aacaf5f4c5b8052cda860a668059d9ef35bb2840c278b7207f3b9f0e1c32915719649edc20bd3cd33b53e97a06159ceac
-Size (git-2.19.0.tar.xz) = 5227124 bytes
+SHA1 (git-2.19.1.tar.xz) = b61b1bdaf0e695a9c76e9a7994bff0c6026ca540
+RMD160 (git-2.19.1.tar.xz) = f03b87ab8ad24e9c7ceb346f25da1ea6621f59e4
+SHA512 (git-2.19.1.tar.xz) = a1bc1032b1de9eb9ea8b7c385cd009f64247e13066e0a91e9682e35400ded05f88c23b523cca4782f57544060d6ba0f9d3bec944399cda5771a4945c38bb9b98
+Size (git-2.19.1.tar.xz) = 5227908 bytes
 SHA1 (patch-Makefile) = 41955729837095abc055850751cce19023e7a2d1
 SHA1 (patch-ac) = e5d2112d158fe493a89b244a10d2e4b998a23d98
 SHA1 (patch-af) = 06460f220b4703a1ff98809006ec1aed5017bb23
diff -r ba344db8db9c -r a0a6b4b784ea devel/git/Makefile.version
--- a/devel/git/Makefile.version        Sun Sep 30 18:42:44 2018 +0000
+++ b/devel/git/Makefile.version        Sat Oct 06 12:03:41 2018 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile.version,v 1.73 2018/09/13 10:56:42 adam Exp $
+# $NetBSD: Makefile.version,v 1.73.2.1 2018/10/06 12:03:41 spz Exp $
 #
 # used by devel/git/Makefile.common
 # used by devel/git-cvs/Makefile
 # used by devel/git-svn/Makefile
 
-GIT_VERSION=   2.19.0
+GIT_VERSION=   2.19.1