<div dir="ltr">>> <span style="font-size:13px">For this to </span><span style="font-size:13px">actually turn into an exploit the attacker needs write access to the </span><span style="font-size:13px">git repository which is generally difficult to achieve</span><div><span style="font-size:13px"><br></span></div><div><span style="font-size:13px">Unless I'm missing something, this would also work on a local clone of a repo, since a local clone is just as much a Git repository as anything that's remotely hosted.</span></div><div><br></div><div><span style="font-size:13px">>> am glad to see the free software mentality is still alive and well; </span><span style="font-size:13px">in the first URL above the git developers gave a big thanks to the </span><span style="font-size:13px">mercurial (!) developers for drawing this issue to their attention. </span><span style="font-size:13px">And kudos to the git developers for paying attention to the mercurial </span><span style="font-size:13px">developers.</span><br></div><div><span style="font-size:13px"><br></span></div><div>Totally agree, and the speed at which this bug was reported, fixed, and deployed was exemplary. Amazing how much cooperation and collaboration (as opposed to "closed walls" & isolation) can facilitate critical fixes. :)</div><div><span style="font-size:13px"><br></span></div><div>Adam</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 19, 2014 at 1:06 PM, Alan W. Irwin <span dir="ltr"><<a href="mailto:irwin@beluga.phys.uvic.ca" target="_blank">irwin@beluga.phys.uvic.ca</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 2014-12-19 07:13-0800 Adam Parkin wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Doesn't affect most Linux users (though they're still encouraged to upgrade<br>
as well), but if you're using Git on a case-insensitive filesystem there's<br>
been a fairly nasty vulnerability discovered:<br>
<br>
<a href="http://article.gmane.org/gmane.linux.kernel/1853266" target="_blank">http://article.gmane.org/<u></u>gmane.linux.kernel/1853266</a><br>
<a href="https://github.com/blog/1938-git-client-vulnerability-announced" target="_blank">https://github.com/blog/1938-<u></u>git-client-vulnerability-<u></u>announced</a><br>
<a href="http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html" target="_blank">http://git-blame.blogspot.com.<u></u>es/2014/12/git-1856-195-205-<u></u>214-and-221-and.html</a><br>
</blockquote>
<br></div></div>
Thanks for bringing this to the attention of the list. For this to<br>
actually turn into an exploit the attacker needs write access to the<br>
git repository which is generally difficult to achieve. So it sounds<br>
like a "due diligence" git client security update is needed (as<br>
opposed to an emergency security update) for the only platforms<br>
affected (Mac OS X and Windows).<br>
<br>
I am glad to see the free software mentality is still alive and well;<br>
in the first URL above the git developers gave a big thanks to the<br>
mercurial (!) developers for drawing this issue to their attention.<br>
And kudos to the git developers for paying attention to the mercurial<br>
developers. I just don't think you would see such cooperation and<br>
trust between proprietary software projects.<br>
<br>
Alan<br>
__________________________<br>
Alan W. Irwin<br>
<br>
Astronomical research affiliation with Department of Physics and Astronomy,<br>
University of Victoria (<a href="http://astrowww.phys.uvic.ca" target="_blank">astrowww.phys.uvic.ca</a>).<br>
<br>
Programming affiliations with the FreeEOS equation-of-state<br>
implementation for stellar interiors (<a href="http://freeeos.sf.net" target="_blank">freeeos.sf.net</a>); the Time<br>
Ephemerides project (<a href="http://timeephem.sf.net" target="_blank">timeephem.sf.net</a>); PLplot scientific plotting<br>
software package (<a href="http://plplot.sf.net" target="_blank">plplot.sf.net</a>); the libLASi project<br>
(<a href="http://unifont.org/lasi" target="_blank">unifont.org/lasi</a>); the Loads of Linux Links project (<a href="http://loll.sf.net" target="_blank">loll.sf.net</a>);<br>
and the Linux Brochure Project (<a href="http://lbproject.sf.net" target="_blank">lbproject.sf.net</a>).<br>
__________________________<br>
<br>
Linux-powered Science<br>
__________________________<br>
______________________________<u></u>_________________<br>
Discuss mailing list<br>
<a href="mailto:Discuss@vlug.org" target="_blank">Discuss@vlug.org</a><br>
<a href="http://lists.vlug.org/mailman/listinfo/discuss" target="_blank">http://lists.vlug.org/mailman/<u></u>listinfo/discuss</a><br>
</blockquote></div></div>