{"thread":{"id":"53237","subject":"Media query - Git flaw","startedAt":"2020-04-15T10:47:07Z","lastAt":"2020-04-21T08:46:18Z","messageCount":4,"participants":["Adam Bannister","Junio C Hamano","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"395486","messageId":"CAJQu+bp9SrzaMBuMv1UC8y8rJGn15MAsVogSCm_DNDKRMji1+Q@mail.gmail.com","threadId":"53237","inReplyTo":null,"subject":"Media query - Git flaw","fromName":"Adam Bannister","fromEmail":"adam.bannister@portswigger.net","sentAt":"2020-04-15T10:46:04Z","receivedAt":"2020-04-15T10:47:07Z","isPatch":false,"sender":{"key":"adam.bannister@portswigger.net","avatar":null},"body":"Hi there,\n\nI’m writing a story for web security publication The Daily Swig on the\nresearch that uncovered a bug in Git:\n\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2021\n\n\nI was wondering if someone who works on Git might have time to spare\nto answer a question or two briefly?\n\nIf so, this is what I was thinking…\n\nHow did the disclosure and patching process go?\n\n\nWhat is your advice to Git users?\n\nThanks for your time...\n\nRegards,\n\n\n--\n\nAdam Bannister\nThe Daily Swig\nhttps://portswigger.net/daily-swig\n"},{"id":"395502","messageId":"xmqqwo6g7p55.fsf@gitster.c.googlers.com","threadId":"53237","inReplyTo":"CAJQu+bp9SrzaMBuMv1UC8y8rJGn15MAsVogSCm_DNDKRMji1+Q@mail.gmail.com","subject":"Re: Media query - Git flaw","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-04-15T15:19:18Z","receivedAt":"2020-04-15T15:19:27Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Adam Bannister writes:\n\n> How did the disclosure and patching process go?\n\nI guess \"Just like any other project\" would be enough for you to\nunderstand, given what you write and where ;-)\n\nA security researcher discloses a possible vulnerability to the\ngit-security mailing list, which is a closed list. On the list,\nthere are developers with relatively high familiarity with the\nentire codebase, and there are those who are responsible for\nmanaging binary packaging of the software to various distributions.\n\nWe prepare the fix. We review the fix. We repeat until we agree\nthat the proposed fix is what we want to deliver.\n\nWe arrange the coordinated disclosure and release among distro\npeople and other stakeholders.\n\nAll of the above have to be done behind public.\n\nThen we go public at the same time. It happened at 1100 US/Pacific\non Apr 14th, 2020. For this one, as the fix itself was relatively\nstraight-forward, the time it took between the initial contact and\nthe release was spent mostly to wait for the slowest partcipant in\nthe coordinated disclosure process (obviously I won't name names).\n\n> What is your advice to Git users?\n\nRelease is announced and users are urged to upgrade, like you wrote\non your article at The Daily Swig.\n"},{"id":"395506","messageId":"20200415154711.GD2464307@coredump.intra.peff.net","threadId":"53237","inReplyTo":"xmqqwo6g7p55.fsf@gitster.c.googlers.com","subject":"Re: Media query - Git flaw","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2020-04-15T15:47:11Z","receivedAt":"2020-04-15T15:47:19Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Apr 15, 2020 at 08:19:18AM -0700, Junio C Hamano wrote:\n\n> > What is your advice to Git users?\n> \n> Release is announced and users are urged to upgrade, like you wrote\n> on your article at The Daily Swig.\n\nThere's a little more detail and some workarounds discussed in the\nadvisory at:\n\n https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q\n\n-Peff\n"},{"id":"395816","messageId":"CAJQu+boAfXKG_Kugmh+k2O_AP2LmGbZ+R5XS0rw9==7OtULEZg@mail.gmail.com","threadId":"53237","inReplyTo":"20200415154711.GD2464307@coredump.intra.peff.net","subject":"Re: Media query - Git flaw","fromName":"Adam Bannister","fromEmail":"adam.bannister@portswigger.net","sentAt":"2020-04-21T08:46:03Z","receivedAt":"2020-04-21T08:46:18Z","isPatch":false,"sender":{"key":"adam.bannister@portswigger.net","avatar":null},"body":"Forgot to say thanks for all your help and share the link!\nhttps://portswigger.net/daily-swig/git-security-newline-injection-bug-tricked-version-control-system-into-leaking-usernames-and-password\n\nMuch appreciated...\n\nOn Wed, 15 Apr 2020 at 16:47, Jeff King wrote:\n>\n> On Wed, Apr 15, 2020 at 08:19:18AM -0700, Junio C Hamano wrote:\n>\n> > > What is your advice to Git users?\n> >\n> > Release is announced and users are urged to upgrade, like you wrote\n> > on your article at The Daily Swig.\n>\n> There's a little more detail and some workarounds discussed in the\n> advisory at:\n>\n> https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q\n>\n> -Peff\n\n\n\n-- \n\nAdam Bannister\nThe Daily Swig\nhttps://portswigger.net/daily-swig\n"}]}