| Message ID | 20240314122748.27704-1-nicolas.cavallari@green-communications.fr |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/1] package/libgit2: bump version to 1.7.2 | expand |
>>>>> "Nicolas" == Nicolas Cavallari <nicolas.cavallari@green-communications.fr> writes: > Fixes CVE-2024-24575 (infinite loop DoS on revision lookup) and > CVE-2024-24577 (heap out of bound write on index update) > Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Committed after marking it as a security bump in the subject so I don't forget to backport it to the stable branches, thanks.
>>>>> "Nicolas" == Nicolas Cavallari <nicolas.cavallari@green-communications.fr> writes: > Fixes CVE-2024-24575 (infinite loop DoS on revision lookup) and > CVE-2024-24577 (heap out of bound write on index update) > Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Committed to 2024.02.x and 2023.11.x, thanks. For 2023.02.x I have instead bumped to 1.6.5, which contains the same fixes.
diff --git a/package/libgit2/libgit2.hash b/package/libgit2/libgit2.hash index 76d599b81e..022fb35a9c 100644 --- a/package/libgit2/libgit2.hash +++ b/package/libgit2/libgit2.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 17d2b292f21be3892b704dddff29327b3564f96099a1c53b00edc23160c71327 libgit2-1.7.1.tar.gz +sha256 de384e29d7efc9330c6cdb126ebf88342b5025d920dcb7c645defad85195ea7f libgit2-1.7.2.tar.gz sha256 6f3c2cd59b057e366c1acc073b038135c52d77892bb33bd4d931c5369d3f062b COPYING diff --git a/package/libgit2/libgit2.mk b/package/libgit2/libgit2.mk index 46ccc1e517..498b665808 100644 --- a/package/libgit2/libgit2.mk +++ b/package/libgit2/libgit2.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBGIT2_VERSION = 1.7.1 +LIBGIT2_VERSION = 1.7.2 LIBGIT2_SITE = $(call github,libgit2,libgit2,v$(LIBGIT2_VERSION)) LIBGIT2_LICENSE = \ GPL-2.0 with linking exception, \
Fixes CVE-2024-24575 (infinite loop DoS on revision lookup) and CVE-2024-24577 (heap out of bound write on index update) Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> --- package/libgit2/libgit2.hash | 2 +- package/libgit2/libgit2.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)