{"thread":{"id":"40153","subject":"Where to report security vulnerabilities in git?","startedAt":"2015-08-21T22:55:19Z","lastAt":"2015-08-24T04:13:22Z","messageCount":4,"participants":["Guido Vranken","Stefan Beller","Junio C Hamano","Sitaram Chamarty"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"268463","messageId":"CAO5O-EKaarYDBd-cpVvKVXTWfKm10ttqd3A6wNe2cXGriGux1A@mail.gmail.com","threadId":"40153","inReplyTo":null,"subject":"Where to report security vulnerabilities in git?","fromName":"Guido Vranken","fromEmail":"guidovranken@gmail.com","sentAt":"2015-08-21T22:55:19Z","receivedAt":"2015-08-21T22:55:19Z","isPatch":false,"sender":{"key":"guidovranken@gmail.com","avatar":null},"body":"List,\n\nI would like to report security vulnerabilities in git. Due to the\nsensitive nature of security-impacting bugs I would like to know if\nthere's a dedicated e-mail address for this, so that the issues at\nplay can be patched prior to a coordinated public disclosure of the\ngermane exploitation details. I did find an older thread in the\narchive addressing this question (\nhttp://thread.gmane.org/gmane.comp.version-control.git/260328/ ), but\nbecause I'm unsure if those e-mail addresses are still relevant, I'm\nasking again.\n\nThanks.\n\nGuido\n"},{"id":"268465","messageId":"CAGZ79kZdkcZQKxZ+M8WoXDZ6J=nk7C1E-JTBEcYYwTB_kORNjQ@mail.gmail.com","threadId":"40153","inReplyTo":"CAO5O-EKaarYDBd-cpVvKVXTWfKm10ttqd3A6wNe2cXGriGux1A@mail.gmail.com","subject":"Re: Where to report security vulnerabilities in git?","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2015-08-22T00:02:53Z","receivedAt":"2015-08-22T00:02:53Z","isPatch":false,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"The addresses are still valid. (I think there was a plan to introduce\na git-security@...\nbut I am not sure if that happened.)\n\n> Current practice is to contact Junio C Hamano pobox.com>.\n> Cc-ing Jeff King peff.net> isn't a bad idea while at it.\n\nJust go for that.\n\n\nOn Fri, Aug 21, 2015 at 3:55 PM, Guido Vranken wrote:\n> List,\n>\n> I would like to report security vulnerabilities in git. Due to the\n> sensitive nature of security-impacting bugs I would like to know if\n> there's a dedicated e-mail address for this, so that the issues at\n> play can be patched prior to a coordinated public disclosure of the\n> germane exploitation details. I did find an older thread in the\n> archive addressing this question (\n> http://thread.gmane.org/gmane.comp.version-control.git/260328/ ), but\n> because I'm unsure if those e-mail addresses are still relevant, I'm\n> asking again.\n>\n> Thanks.\n>\n> Guido\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at http://vger.kernel.org/majordomo-info.html\n"},{"id":"268467","messageId":"CAPc5daUYCyJFr_4-u60QGZavxEM=TZSWq_6O7C4E5kuG+gPy7w@mail.gmail.com","threadId":"40153","inReplyTo":"CAO5O-EKaarYDBd-cpVvKVXTWfKm10ttqd3A6wNe2cXGriGux1A@mail.gmail.com","subject":"Re: Where to report security vulnerabilities in git?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-08-22T00:16:20Z","receivedAt":"2015-08-22T00:16:20Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"On Fri, Aug 21, 2015 at 3:55 PM, Guido Vranken wrote:\n> germane exploitation details. I did find an older thread in the\n> archive addressing this question (\n> http://thread.gmane.org/gmane.comp.version-control.git/260328/ ), but\n> because I'm unsure if those e-mail addresses are still relevant, I'm\n> asking again.\n\nIndeed that was an old advice. Recent releases of \"A note from the\nmaintainer\" has this paragraph:\n\nIf you think you found a security-sensitive issue and want to disclose\nit to us without announcing it to wider public, please contact us at\nour security mailing list .\n"},{"id":"268550","messageId":"55DA99E2.7090707@gmail.com","threadId":"40153","inReplyTo":"CAO5O-EKaarYDBd-cpVvKVXTWfKm10ttqd3A6wNe2cXGriGux1A@mail.gmail.com","subject":"Re: Where to report security vulnerabilities in git?","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2015-08-24T04:13:22Z","receivedAt":"2015-08-24T04:13:22Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On 08/22/2015 04:25 AM, Guido Vranken wrote:\n> List,\n> \n> I would like to report security vulnerabilities in git. Due to the\n> sensitive nature of security-impacting bugs I would like to know if\n> there's a dedicated e-mail address for this, so that the issues at\n> play can be patched prior to a coordinated public disclosure of the\n> germane exploitation details. I did find an older thread in the\n> archive addressing this question (\n> http://thread.gmane.org/gmane.comp.version-control.git/260328/ ), but\n> because I'm unsure if those e-mail addresses are still relevant, I'm\n> asking again.\n\nIf it has anything to do with remote access (via ssh or http) please\ncopy me also. I wrote/write/maintain gitolite, which is a reasonably\nsuccessful access control system for git servers.\n\nregards\nsitaram\n\n\n"}]}