CVS commit: pkgsrc/devel/libgit2

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Jun  5 18:48:23 UTC 2018

Modified Files:
        pkgsrc/devel/libgit2: Makefile distinfo

Log Message:
libgit2: update to 0.27.1.

v0.27.1
---------

This is a security release fixing insufficient validation of submodule names
(CVE-2018-11235, reported by Etienne Stalmans) and disallows `.gitmodules` files
as symlinks.

While submodule names come from the untrusted ".gitmodules" file, we blindly
append the name to "$GIT_DIR/modules" to construct the final path of the
submodule repository. In case the name contains e.g. "../", an adversary would
be able to escape your repository and write data at arbitrary paths. In
accordance with git, we now enforce some rules for submodule names which will
cause libgit2 to ignore these malicious names.

Adding a symlink as `.gitmodules` into the index from the workdir or checking
out such files is not allowed as this can make a Git implementation write
outside of the repository and bypass the `fsck` checks for CVE-2018-11235.

libgit2 is not susceptible to CVE-2018-11233.


To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.26 pkgsrc/devel/libgit2/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/devel/libgit2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libgit2/Makefile
diff -u pkgsrc/devel/libgit2/Makefile:1.25 pkgsrc/devel/libgit2/Makefile:1.26
--- pkgsrc/devel/libgit2/Makefile:1.25  Sun Apr 29 21:31:33 2018
+++ pkgsrc/devel/libgit2/Makefile       Tue Jun  5 18:48:22 2018
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.25 2018/04/29 21:31:33 adam Exp $
+# $NetBSD: Makefile,v 1.26 2018/06/05 18:48:22 wiz Exp $
 
-DISTNAME=      libgit2-0.27.0
-PKGREVISION=   1
+DISTNAME=      libgit2-0.27.1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libgit2/distinfo
diff -u pkgsrc/devel/libgit2/distinfo:1.11 pkgsrc/devel/libgit2/distinfo:1.12
--- pkgsrc/devel/libgit2/distinfo:1.11  Tue Apr 17 10:50:24 2018
+++ pkgsrc/devel/libgit2/distinfo       Tue Jun  5 18:48:22 2018
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.11 2018/04/17 10:50:24 wiz Exp $
+$NetBSD: distinfo,v 1.12 2018/06/05 18:48:22 wiz Exp $
 
-SHA1 (libgit2-0.27.0.tar.gz) = a545ed6d67833b4dbcce32db7a7d757b14165493
-RMD160 (libgit2-0.27.0.tar.gz) = 2b9a8fb2e00dceb8c764d84a70898e4dd745a8f0
-SHA512 (libgit2-0.27.0.tar.gz) = 1304f0b6182e1e6e7fccbec1a568aefb662e144a1aea4fff5901f3c012ff0f3d28720f17d19b9a1bc6c892c32fe602766fe98a15538a94a468d65d3e4a1680ca
-Size (libgit2-0.27.0.tar.gz) = 4761312 bytes
+SHA1 (libgit2-0.27.1.tar.gz) = 2ce74b2dcec76ee0467a26c0cda8153bd29a2ad4
+RMD160 (libgit2-0.27.1.tar.gz) = 46dd959617292cebdbcb031ef49f62acd6e5e62f
+SHA512 (libgit2-0.27.1.tar.gz) = 4cdee4aec0f0c7b36226ee29276b8802d6b59817f95b1357f35225c23a8d6de70242b2dd9a5fb3b765c3242f4ed1848933e20fc24899071d8b443d46c43ce99d
+Size (libgit2-0.27.1.tar.gz) = 4765926 bytes