diff options
| author | leot <leot@pkgsrc.org> | 2020-04-20 20:03:32 +0000 |
|---|---|---|
| committer | leot <leot@pkgsrc.org> | 2020-04-20 20:03:32 +0000 |
| commit | 06e93d875b5ad7355a46f1ab95b9c41f3c5930a0 (patch) | |
| tree | 76c7f9721a8a2754be6d9c84c5fc91c9711438ee /devel/git | |
| parent | cff1a4322d767d5e39e5b1c3b7add825bae7f3c1 (diff) | |
| download | pkgsrc-06e93d875b5ad7355a46f1ab95b9c41f3c5930a0.tar.gz | |
git: Update to 2.26.2
Changes:
2.26.2
------
This release is to address the security issue: CVE-2020-11008
* With a crafted URL that contains a newline or empty host, or lacks
a scheme, the credential helper machinery can be fooled into
providing credential information that is not appropriate for the
protocol in use and host being contacted.
Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the
credentials are not for a host of the attacker's choosing; instead,
they are for some unspecified host (based on how the configured
credential helper handles an absent "host" parameter).
The attack has been made impossible by refusing to work with
under-specified credential patterns.
Credit for finding the vulnerability goes to Carlo Arenas.
Diffstat (limited to 'devel/git')
| -rw-r--r-- | devel/git/Makefile.version | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/devel/git/Makefile.version b/devel/git/Makefile.version index 858984228ab..889817a1351 100644 --- a/devel/git/Makefile.version +++ b/devel/git/Makefile.version @@ -1,7 +1,7 @@ -# $NetBSD: Makefile.version,v 1.87 2020/04/14 18:27:31 leot Exp $ +# $NetBSD: Makefile.version,v 1.88 2020/04/20 20:03:32 leot Exp $ # # used by devel/git/Makefile.common # used by devel/git-cvs/Makefile # used by devel/git-svn/Makefile -GIT_VERSION= 2.26.1 +GIT_VERSION= 2.26.2 |