diff options
| author | wiz <wiz> | 2016-04-08 20:57:36 +0000 |
|---|---|---|
| committer | wiz <wiz> | 2016-04-08 20:57:36 +0000 |
| commit | 4aef4f695568061888535aa313554cb6782bff97 (patch) | |
| tree | c48a80ec6e39d12d1a2a88c6dd01e27e9c470165 /devel/py-mercurial | |
| parent | d443cdbb06e93a170b05090a951d0224bf2cf9f5 (diff) | |
| download | pkgsrc-4aef4f695568061888535aa313554cb6782bff97.tar.gz | |
Update py-mercurial to 3.7.3.
This is an out of cycle release to address three security issues:
CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
Mercurial prior to 3.7.3 contained two bounds-checking errors in its binary delta decoder that may be exploitable via clone, push, or pull.
CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
Mercurial prior to 3.7.3 allowed URLs for Git subrepos that could result in arbitrary code execution on clone. This is a further side-effect of Git CVE-2015-7545. Reported by Blake Burkhart.
CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
Mercurial prior to 3.7.3 allowed arbitrary code execution when converting Git repos with hostile names. This could affect automated conversion services. Reported by Blake Burkhart.
bdiff: (pure) support array.array arrays (issue5130)
convert: add new, non-clowny interface for shelling out to git (SEC)
convert: dead code removal - old git calling functions (SEC)
convert: rewrite calls to Git to use the new shelling mechanism (SEC)
convert: rewrite gitpipe to use common.commandline (SEC)
convert: test for shell injection in git calls (SEC)
files: don't recurse into subrepos without a path or -S (issue5127)
hg: perform update after pulling during clone with share (issue5103)
mq: restrict generated patch name to 75 characters (issue5117)
obsolete: fix n^2 marker computation behavior
parsers: detect short records (SEC)
parsers: fix list sizing rounding error (SEC)
streamclone: fix error when store files grow while stream cloning
subrepo: adapt to git's recent renames-by-default
subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC)
Diffstat (limited to 'devel/py-mercurial')
| -rw-r--r-- | devel/py-mercurial/Makefile.version | 4 | ||||
| -rw-r--r-- | devel/py-mercurial/distinfo | 10 |
2 files changed, 7 insertions, 7 deletions
diff --git a/devel/py-mercurial/Makefile.version b/devel/py-mercurial/Makefile.version index 6b9b11e51fb..386e2cdbf32 100644 --- a/devel/py-mercurial/Makefile.version +++ b/devel/py-mercurial/Makefile.version @@ -1,6 +1,6 @@ -# $NetBSD: Makefile.version,v 1.31 2016/03/02 19:31:13 wiz Exp $ +# $NetBSD: Makefile.version,v 1.32 2016/04/08 20:57:36 wiz Exp $ -VERSION= 3.7.2 +VERSION= 3.7.3 PYTHON_VERSIONS_INCOMPATIBLE= 33 34 35 # not yet ported as of 3.4.1 # see also http://mercurial.selenic.com/wiki/SupportedPythonVersions diff --git a/devel/py-mercurial/distinfo b/devel/py-mercurial/distinfo index 8a13807de52..8fb6c1ba370 100644 --- a/devel/py-mercurial/distinfo +++ b/devel/py-mercurial/distinfo @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.32 2016/03/02 19:31:13 wiz Exp $ +$NetBSD: distinfo,v 1.33 2016/04/08 20:57:36 wiz Exp $ -SHA1 (mercurial-3.7.2.tar.gz) = d684386cfe7a1f4170243ce51c78e64ee1cd8d75 -RMD160 (mercurial-3.7.2.tar.gz) = ac59bdef478819f25124035ae55d28fd121128ab -SHA512 (mercurial-3.7.2.tar.gz) = 573b35052ec50f4672cdd5afd93080edc864deb854b890c8cedba53c40d6d3a37a560e364b94b819cfc6d9fc5c07c0411a13167f0888007e5c9366bc94154306 -Size (mercurial-3.7.2.tar.gz) = 4634748 bytes +SHA1 (mercurial-3.7.3.tar.gz) = e3bcabc2fb119e61235ef2b714fc536142ddc01b +RMD160 (mercurial-3.7.3.tar.gz) = 720aee6d31efabc24163e727c890e337d3568984 +SHA512 (mercurial-3.7.3.tar.gz) = 7f9f97229e40c7092c16ccf227b19a08a9839d8ce19a9d057341fff75876bff32241ee9aa10eab293f779ea3e8a1d97577597187bd96251fb499cbb1075a82cf +Size (mercurial-3.7.3.tar.gz) = 4636732 bytes SHA1 (patch-mercurial_repoview.py) = 7d154dd2186edf5311dfc8902638857a72ba6129 SHA1 (patch-tests_test-commandserver.t) = 12c3092e3e832b414dd4155ffb678b7f0612495d |