kumquat-buildroot/package/libgit2/libgit2.hash

# Locally calculated
sha256	30f3877469d09f2e4a21be933b4e2800560d16646028dd800744dc5f7fb0c749  libgit2-0.28.4.tar.gz
sha256	d9a8038088df84fde493fa33a0f1e537252eeb9642122aa4b862690197152813  COPYING
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2018-02-14 12:13:51 +01:00			`# Locally calculated`
package/libgit2: security bump to version 0.28.4 Fixes the following CVE: - CVE-2019-1351: Windows provides the ability to substitute drive letters with arbitrary letters, including multi-byte Unicode letters. To fix any potential issues arising from interpreting such paths as relative paths, we have extended detection of DOS drive prefixes to accomodate for such cases. - CVE-2019-1352: by using NTFS-style alternative file streams for the ".git" directory, it is possible to overwrite parts of the repository. While this has been fixed in the past for Windows, the same vulnerability may also exist on other systems that write to NTFS filesystems. We now reject any paths starting with ".git:" on all systems. - CVE-2019-1353: by using NTFS-style 8.3 short names, it was possible to write to the ".git" directory and thus overwrite parts of the repository, leading to possible remote code execution. While this problem was already fixed in the past for Windows, other systems accessing NTFS filesystems are vulnerable to this issue too. We now enable NTFS protecions by default on all systems to fix this attack vector. - CVE-2019-1354: on Windows, backslashes are not a valid part of a filename but are instead interpreted as directory separators. As other platforms allowed to use such paths, it was possible to write such invalid entries into a Git repository and was thus an attack vector to write into the ".git" dierctory. We now reject any entries starting with ".git" on all systems. libgit2 is not affected by these git CVE: - CVE-2019-1348: the fast-import stream command "feature export-marks=path" allows writing to arbitrary file paths. - CVE-2019-1349: by using NTFS 8.3 short names, backslashes or alternate filesystreams, it is possible to cause submodules to be written into pre-existing directories during a recursive clone using git. - CVE-2019-1350: recursive clones may lead to arbitrary remote code executing due to improper quoting of command line arguments. - CVE-2019-1387: it is possible to let a submodule's git directory point into a sibling's submodule directory, which may result in overwriting parts of the Git repository and thus lead to arbitrary command execution. As libgit2 doesn't provide any way to do submodule clones natively, it is not susceptible to this vulnerability. Users of libgit2 that have implemented recursive submodule clones manually are encouraged to review their implementation for this vulnerability. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2019-12-16 12:53:59 +01:00			`sha256 30f3877469d09f2e4a21be933b4e2800560d16646028dd800744dc5f7fb0c749 libgit2-0.28.4.tar.gz`
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2018-02-14 12:13:51 +01:00			`sha256 d9a8038088df84fde493fa33a0f1e537252eeb9642122aa4b862690197152813 COPYING`