{"thread":{"id":"31775","subject":"Fwd: potential path traversal issue in v3 with wild repos","startedAt":"2012-10-10T01:11:41Z","lastAt":"2012-10-10T01:11:41Z","messageCount":1,"participants":["Sitaram Chamarty"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"200871","messageId":"CAMK1S_hptJKtNJMKOr4ADgMqUoG1S9mQOTPrYV7egRhxW7ic6w@mail.gmail.com","threadId":"31775","inReplyTo":"CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com","subject":"Fwd: potential path traversal issue in v3 with wild repos","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2012-10-10T01:11:41Z","receivedAt":"2012-10-10T01:11:41Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"oops; forgot to add the git list earlier.\n\n---------- Forwarded message ----------\nFrom: Sitaram Chamarty <sitaramc@gmail.com>\nDate: Wed, Oct 10, 2012 at 5:15 AM\nSubject: potential path traversal issue in v3 with wild repos\nTo: gitolite <gitolite@googlegroups.com>, gitolite-announce@googlegroups.com\nCc: Stephane Chazelas <stephane.chazelas@gmail.com>\n\n\nHello all,\n\nI'm sorry to say there is a potential path traversal vulnerability in\nv3.  Thanks to Stephane (copied) for finding it and alerting me.\n\nCan it affect you?  This can only affect you if you are using wild\ncard repos, *and* at least one of your patterns allows the string\n\"../\" to match multiple times.  (As far as I can tell, this does not\naffect v2).\n\nHow badly can it affect you?  A malicious user who *also* has the\nability to create arbitrary files in, say, /tmp (e.g., he has his own\nuserid on the same box), can compromise the entire \"git\" user.\nOtherwise the worst he can do is create arbitrary repos in /tmp.\n\nWhat's the fix?  The fix has been pushed, and tagged v3.1.  This patch\n[1] is also backportable to all v3.x tags, in case you are not ready\nfor an actual upgrade (it will have a slight conflict with v3.0 and\nv3.01 but you should be able to resolve it easily enough; with the\nothers there is no conflict.)\n\nMy sincere apologies for the fsck-up :(\n\n[1]: it's not the top-most commit; be careful if you want to 'git\ncherry-pick' this to an older tree.\n\n--\nSitaram\n\n\n-- \nSitaram\n"}]}