{"thread":{"id":"47692","subject":"GIT 2.3.1 - Code Execution Vulnerability","startedAt":"2018-01-25T17:03:16Z","lastAt":"2018-01-25T19:01:56Z","messageCount":3,"participants":["christian.del.vecchio@zurich.com","Santiago Torres","Dyer, Edwin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"337387","messageId":"201801251702.w0PH2YFI000707@b0d0p4a1.rz.ch.zurich.com","threadId":"47692","inReplyTo":null,"subject":"GIT 2.3.1 - Code Execution Vulnerability","fromName":"","fromEmail":"christian.del.vecchio@zurich.com","sentAt":"2018-01-25T17:02:34Z","receivedAt":"2018-01-25T17:03:16Z","isPatch":false,"sender":{"key":"christian.del.vecchio@zurich.com","avatar":null},"body":"dear Team\n\nI am Christian Del Vecchio,and i work in the infrastructure of Middleware on Zurich.\nwe have installed in our system Sun your product in order to connect to our bitbucket repository.\n\nwe have followed the instruction provided on your Web Page:\n\nhttps://git-scm.com/download/linux\npkgutil -i git\n\nthe version installed is the 2.3.1, and actually it works.\n\nbut last week our security team informed that this software didn't pass the check control due: Git Server and Client Remote Code Execution Vulnerability\n\n\nplease, is it available a newer version that fix this problem?\n\nour system is: Sun Solaris v10 sparc\n\nbest regards\n__________________________________________ \n\nChristian Del Vecchio \nMiddleware SME \n\nZurich Insurance Group Ltd. \nbac de Roda 58, \nBuilding C, 4th floor \n08019 Barcelona, Spain \n\n64402 (internal) \n+34 93 4465402 (direct) \nchristian.del.vecchio@zurich.com \nhttp://www.zurich.com \n"},{"id":"337388","messageId":"20180125172057.ie3pvhxx5egpil35@LykOS.localdomain","threadId":"47692","inReplyTo":"201801251702.w0PH2YFI000707@b0d0p4a1.rz.ch.zurich.com","subject":"Re: GIT 2.3.1 - Code Execution Vulnerability","fromName":"Santiago Torres","fromEmail":"santiago@nyu.edu","sentAt":"2018-01-25T17:20:58Z","receivedAt":"2018-01-25T17:18:06Z","isPatch":false,"sender":{"key":"santiago@nyu.edu","avatar":"https://avatars.githubusercontent.com/u/3579933?v=4"},"body":"Hi, Christian.\n\nThey are probably talking about one of these[1][2]. I don't have access\nto a solaris machine right now, so I don't know which is the latest\nversion they ship, but they probably backported patches. \n\nHere we can't do much more about it, given that the packagers for your\nsolaris version are the ones (possibly) packaging 2.3.1. I'd email or\nopen a ticket with Oracle after making sure they 1) haven't backported\npatches to fix these, or 2) don't have a newer version in their\nrepositories.\n\nCheers!\n-Santiago.\n\n\n[1] https://security.archlinux.org/CVE-2017-1000117\n[2] https://nvd.nist.gov/vuln/detail/CVE-2016-2324\n\nOn Thu, Jan 25, 2018 at 06:02:34PM +0100, christian.del.vecchio@zurich.com wrote:\n> dear Team\n> \n> I am Christian Del Vecchio,and i work in the infrastructure of Middleware on Zurich.\n> we have installed in our system Sun your product in order to connect to our bitbucket repository.\n> \n> we have followed the instruction provided on your Web Page:\n> \n> https://git-scm.com/download/linux\n> pkgutil -i git\n> \n> the version installed is the 2.3.1, and actually it works.\n> \n> but last week our security team informed that this software didn't pass the check control due: Git Server and Client Remote Code Execution Vulnerability\n> \n> \n> please, is it available a newer version that fix this problem?\n> \n> our system is: Sun Solaris v10 sparc\n> \n> best regards\n> __________________________________________ \n> \n> Christian Del Vecchio \n> Middleware SME \n> \n> Zurich Insurance Group Ltd. \n> bac de Roda 58, \n> Building C, 4th floor \n> 08019 Barcelona, Spain \n> \n> 64402 (internal) \n> +34 93 4465402 (direct) \n> christian.del.vecchio@zurich.com \n> http://www.zurich.com \n"},{"id":"337394","messageId":"BN6PR0101MB293001FE100A016227C04F9EF1E10@BN6PR0101MB2930.prod.exchangelabs.com","threadId":"47692","inReplyTo":"20180125172057.ie3pvhxx5egpil35@LykOS.localdomain","subject":"RE: GIT 2.3.1 - Code Execution Vulnerability","fromName":"Dyer, Edwin","fromEmail":"edwin.dyer@alliancedata.com","sentAt":"2018-01-25T19:01:47Z","receivedAt":"2018-01-25T19:01:56Z","isPatch":false,"sender":{"key":"edwin.dyer@alliancedata.com","avatar":null},"body":"Current Solaris 10/11 version of Git is 2.4.0:\n\nhttps://www.opencsw.org/package/git/\n\n\nEd Dyer\nAssociate DevOps Engineer\n\nAlliance Data Retail Services\n3075 Loyalty Circle, Columbus OH 43219\nOffice: 614-944-3923| Mobile: 614-432-3862\n\n\n\n-----Original Message-----\nFrom: git-owner@vger.kernel.org [mailto:git-owner@vger.kernel.org] On Behalf Of Santiago Torres\nSent: Thursday, January 25, 2018 12:21 PM\nTo: christian.del.vecchio@zurich.com\nCc: git@vger.kernel.org\nSubject: Re: GIT 2.3.1 - Code Execution Vulnerability\n\nHi, Christian.\n\nThey are probably talking about one of these[1][2]. I don't have access to a solaris machine right now, so I don't know which is the latest version they ship, but they probably backported patches. \n\nHere we can't do much more about it, given that the packagers for your solaris version are the ones (possibly) packaging 2.3.1. I'd email or open a ticket with Oracle after making sure they 1) haven't backported patches to fix these, or 2) don't have a newer version in their repositories.\n\nCheers!\n-Santiago.\n\n\n[1] https://security.archlinux.org/CVE-2017-1000117\n[2] https://nvd.nist.gov/vuln/detail/CVE-2016-2324\n\nOn Thu, Jan 25, 2018 at 06:02:34PM +0100, christian.del.vecchio@zurich.com wrote:\n> dear Team\n> \n> I am Christian Del Vecchio,and i work in the infrastructure of Middleware on Zurich.\n> we have installed in our system Sun your product in order to connect to our bitbucket repository.\n> \n> we have followed the instruction provided on your Web Page:\n> \n> https://git-scm.com/download/linux\n> pkgutil -i git\n> \n> the version installed is the 2.3.1, and actually it works.\n> \n> but last week our security team informed that this software didn't \n> pass the check control due: Git Server and Client Remote Code \n> Execution Vulnerability\n> \n> \n> please, is it available a newer version that fix this problem?\n> \n> our system is: Sun Solaris v10 sparc\n> \n> best regards\n> __________________________________________\n> \n> Christian Del Vecchio\n> Middleware SME\n> \n> Zurich Insurance Group Ltd. \n> bac de Roda 58,\n> Building C, 4th floor\n> 08019 Barcelona, Spain\n> \n> 64402 (internal)\n> +34 93 4465402 (direct)\n> christian.del.vecchio@zurich.com\n> http://www.zurich.com\n\n______________________________________________________________________\nThe information contained in this e-mail message and any attachments may be privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this e-mail and delete the message and any attachments from your computer.\n______________________________________________________________________\n"}]}