{"thread":{"id":"16804","subject":"[ANNOUNCE] GIT 1.6.0.6","startedAt":"2008-12-20T06:40:41Z","lastAt":"2008-12-20T10:54:25Z","messageCount":3,"participants":["Junio C Hamano","Jakub Narebski"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"98413","messageId":"7vljub1h92.fsf@gitster.siamese.dyndns.org","threadId":"16804","inReplyTo":null,"subject":"[ANNOUNCE] GIT 1.6.0.6","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-12-20T06:40:41Z","receivedAt":"2008-12-20T06:40:41Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release GIT 1.6.0.6 is available at the\nusual places:\n\n  http://www.kernel.org/pub/software/scm/git/\n\n  git-1.6.0.6.tar.{gz,bz2}\t\t\t(source tarball)\n  git-htmldocs-1.6.0.6.tar.{gz,bz2}\t\t(preformatted docs)\n  git-manpages-1.6.0.6.tar.{gz,bz2}\t\t(preformatted docs)\n\nThe RPM binary packages for a few architectures are also provided\nas courtesy.\n\n  RPMS/$arch/git-*-1.6.0.6-1.fc9.$arch.rpm\t(RPM)\n\nAmong miscellaneous fixes, this contains a local gitweb security fix.\nMaintenance releases for older versions (v1.5.4.7, v1.5.5.6 and v1.5.6.6)\nare also available at the same place.\n\n----------------------------------------------------------------\n\nChanges since v1.6.0.5 are as follows:\n\nDavid Aguilar (1):\n      git-mergetool: properly handle \"git mergetool -- filename\"\n\nDeskin Miller (1):\n      git-svn: Make following parents atomic\n\nJim Meyering (1):\n      git-config.txt: fix a typo\n\nJohannes Schindelin (2):\n      fast-import: close pack before unlinking it\n      fast-export: deal with tag objects that do not have a tagger\n\nJunio C Hamano (6):\n      work around Python warnings from AsciiDoc\n      git-show: do not segfault when showing a bad tag\n      pager: do not dup2 stderr if it is already redirected\n      gitweb: do not run \"git diff\" that is Porcelain\n      GIT 1.5.4.7\n      fast-import: make tagger information optional\n\nLinus Torvalds (1):\n      fsck: reduce stack footprint\n\nMarkus Heidelberg (1):\n      Documentation: fix typos, grammar, asciidoc syntax\n\nMiklos Vajna (1):\n      SubmittingPatches: mention the usage of real name in Signed-off-by: lines\n\nNicolas Pitre (1):\n      make sure packs to be replaced are closed beforehand\n\nWu Fengguang (1):\n      git-send-email: handle email address with quoted comma\n"},{"id":"98414","messageId":"7vhc4z1gys.fsf@gitster.siamese.dyndns.org","threadId":"16804","inReplyTo":"7vljub1h92.fsf@gitster.siamese.dyndns.org","subject":"[Security] gitweb local privilege escalation (fix)","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-12-20T06:46:51Z","receivedAt":"2008-12-20T06:46:51Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Current gitweb has a possible local privilege escalation bug that allows a\nmalicious repository owner to run a command of his choice by specifying\ndiff.external configuration variable in his repository and running a\ncrafted gitweb query.\n\nRecent (post 1.4.3) gitweb itself never generates a link that would result\nin such a query, and the safest and cleanest fix to this issue is to\nsimply drop the support for it.  Maintenance release v1.6.0.6, v1.5.6.6,\nv1.5.5.6 and v1.5.4.7 are already available at k.org (see the announcement\nfor v1.6.0.6 I sent out a few minutes ago), and the master branch and\nothers pushed out tonight have the same fix.\n\nThis message contains two patches (credits go to Matt McCutchen, Jeff King\nand Jakub Narebski) to do the fix yourself:\n\n (1) for Git 1.5.4.X, 1.5.5.X, and 1.5.6.X, and\n\n (2) for Git 1.6.0.X.\n\nDistro packagers and people on the vendor security list have been notified\nabout this fix earlier this week; people running gitweb from vendor\nsupplied binaries should be able to get updates from them as well.\n\n\n\n>From dfff4b7aa42de7e7d58caeebe2c6128449f09b76 Mon Sep 17 00:00:00 2001\nFrom: Junio C Hamano <gitster@pobox.com>\nDate: Tue, 16 Dec 2008 19:42:02 -0800\nSubject: [PATCH] gitweb: do not run \"git diff\" that is Porcelain\n\nJakub says that legacy-style URI to view two blob differences are never\ngenerated since 1.4.3.  This codepath runs \"git diff\" Porcelain from the\ngitweb, which is a no-no.  It can trigger diff.external command that is\nspecified in the configuration file of the repository being viewed.\n\nThis patch applies to v1.5.4 and later.\n\nSigned-off-by: Junio C Hamano <gitster@pobox.com>\n---\n gitweb/gitweb.perl |   38 ++------------------------------------\n 1 files changed, 2 insertions(+), 36 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex b582332..86a6ced 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -4809,43 +4809,9 @@ sub git_blobdiff {\n \t\t\tor die_error(undef, \"Open git-diff-tree failed\");\n \t}\n \n-\t# old/legacy style URI\n-\tif (!%diffinfo && # if new style URI failed\n-\t    defined $hash && defined $hash_parent) {\n-\t\t# fake git-diff-tree raw output\n-\t\t$diffinfo{'from_mode'} = $diffinfo{'to_mode'} = \"blob\";\n-\t\t$diffinfo{'from_id'} = $hash_parent;\n-\t\t$diffinfo{'to_id'}   = $hash;\n-\t\tif (defined $file_name) {\n-\t\t\tif (defined $file_parent) {\n-\t\t\t\t$diffinfo{'status'} = '2';\n-\t\t\t\t$diffinfo{'from_file'} = $file_parent;\n-\t\t\t\t$diffinfo{'to_file'}   = $file_name;\n-\t\t\t} else { # assume not renamed\n-\t\t\t\t$diffinfo{'status'} = '1';\n-\t\t\t\t$diffinfo{'from_file'} = $file_name;\n-\t\t\t\t$diffinfo{'to_file'}   = $file_name;\n-\t\t\t}\n-\t\t} else { # no filename given\n-\t\t\t$diffinfo{'status'} = '2';\n-\t\t\t$diffinfo{'from_file'} = $hash_parent;\n-\t\t\t$diffinfo{'to_file'}   = $hash;\n-\t\t}\n-\n-\t\t# non-textual hash id's can be cached\n-\t\tif ($hash =~ m/^[0-9a-fA-F]{40}$/ &&\n-\t\t    $hash_parent =~ m/^[0-9a-fA-F]{40}$/) {\n-\t\t\t$expires = '+1d';\n-\t\t}\n-\n-\t\t# open patch output\n-\t\topen $fd, \"-|\", git_cmd(), \"diff\", @diff_opts,\n-\t\t\t'-p', ($format eq 'html' ? \"--full-index\" : ()),\n-\t\t\t$hash_parent, $hash, \"--\"\n-\t\t\tor die_error(undef, \"Open git-diff failed\");\n-\t} else  {\n+\t# old/legacy style URI -- not generated anymore since 1.4.3.\n+\tif (!%diffinfo) {\n \t\tdie_error('404 Not Found', \"Missing one of the blob diff parameters\")\n-\t\t\tunless %diffinfo;\n \t}\n \n \t# header\n-- \n1.6.1.rc3.19.g66a9\n\n\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex ced7bb7..804670c 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -4863,43 +4863,9 @@ sub git_blobdiff {\n \t\t\tor die_error(500, \"Open git-diff-tree failed\");\n \t}\n \n-\t# old/legacy style URI\n-\tif (!%diffinfo && # if new style URI failed\n-\t    defined $hash && defined $hash_parent) {\n-\t\t# fake git-diff-tree raw output\n-\t\t$diffinfo{'from_mode'} = $diffinfo{'to_mode'} = \"blob\";\n-\t\t$diffinfo{'from_id'} = $hash_parent;\n-\t\t$diffinfo{'to_id'}   = $hash;\n-\t\tif (defined $file_name) {\n-\t\t\tif (defined $file_parent) {\n-\t\t\t\t$diffinfo{'status'} = '2';\n-\t\t\t\t$diffinfo{'from_file'} = $file_parent;\n-\t\t\t\t$diffinfo{'to_file'}   = $file_name;\n-\t\t\t} else { # assume not renamed\n-\t\t\t\t$diffinfo{'status'} = '1';\n-\t\t\t\t$diffinfo{'from_file'} = $file_name;\n-\t\t\t\t$diffinfo{'to_file'}   = $file_name;\n-\t\t\t}\n-\t\t} else { # no filename given\n-\t\t\t$diffinfo{'status'} = '2';\n-\t\t\t$diffinfo{'from_file'} = $hash_parent;\n-\t\t\t$diffinfo{'to_file'}   = $hash;\n-\t\t}\n-\n-\t\t# non-textual hash id's can be cached\n-\t\tif ($hash =~ m/^[0-9a-fA-F]{40}$/ &&\n-\t\t    $hash_parent =~ m/^[0-9a-fA-F]{40}$/) {\n-\t\t\t$expires = '+1d';\n-\t\t}\n-\n-\t\t# open patch output\n-\t\topen $fd, \"-|\", git_cmd(), \"diff\", @diff_opts,\n-\t\t\t'-p', ($format eq 'html' ? \"--full-index\" : ()),\n-\t\t\t$hash_parent, $hash, \"--\"\n-\t\t\tor die_error(500, \"Open git-diff failed\");\n-\t} else  {\n-\t\tdie_error(400, \"Missing one of the blob diff parameters\")\n-\t\t\tunless %diffinfo;\n+\t# old/legacy style URI -- not generated anymore since 1.4.3.\n+\tif (!%diffinfo) {\n+\t\tdie_error('404 Not Found', \"Missing one of the blob diff parameters\")\n \t}\n \n \t# header\n"},{"id":"98427","messageId":"m3myerce39.fsf@localhost.localdomain","threadId":"16804","inReplyTo":"7vhc4z1gys.fsf@gitster.siamese.dyndns.org","subject":"Re: [Security] gitweb local privilege escalation (fix)","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2008-12-20T10:54:25Z","receivedAt":"2008-12-20T10:54:25Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> Current gitweb has a possible local privilege escalation bug that allows a\n> malicious repository owner to run a command of his choice by specifying\n> diff.external configuration variable in his repository and running a\n> crafted gitweb query.\n> \n> Recent (post 1.4.3) gitweb itself never generates a link that would result\n> in such a query, and the safest and cleanest fix to this issue is to\n> simply drop the support for it.  Maintenance release v1.6.0.6, v1.5.6.6,\n> v1.5.5.6 and v1.5.4.7 are already available at k.org (see the announcement\n> for v1.6.0.6 I sent out a few minutes ago), and the master branch and\n> others pushed out tonight have the same fix.\n\n>From what I have found diff.external works only since v1.5.4 (see\ncommit cbe02100), so when gitweb started using git-diff for old\nlegacy links to not use $tmpdir and /usr/bin/diff -u it wasn't an\nissue...\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"}]}