{"thread":{"id":"57526","subject":"Possible bug reports for git-credential-libsecret","startedAt":"2022-03-09T17:52:40Z","lastAt":"2022-03-09T17:52:40Z","messageCount":1,"participants":[],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"450894","messageId":"CAPb83E-1Ken14G9xdyw9MqZ6AiAZkwDuwRf_5NmqoUEvHcAqYQ@mail.gmail.com","threadId":"57526","inReplyTo":null,"subject":"Possible bug reports for git-credential-libsecret","fromName":"","fromEmail":"","sentAt":"2022-03-09T17:53:44Z","receivedAt":"2022-03-09T17:52:40Z","isPatch":false,"sender":null,"body":"Dear Git Development team\n\nHi.\nRecently, I noted that the vulnerability patch (CVE-2020-5260) for\n\"git credential\" is not applied in the \"git-credential-libsecret\"\nprogram (./contrib/credential/libsecret/git-credential-libsecret.c).\n\nActually, I'm not sure whether \"git-credential-libsecret\" is actually\nused. But it can be potentially intimidating, thus it would be good to\napply the same patch of \"git credential\" to\n\"git-credential-libsecret\".\n\n- Patch for CVE-2020-5260\n   * https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b\n\n- Similar but not patched code in \"git-credential-libsecret\"\n   * https://github.com/git/git/blob/master/contrib/credential/libsecret/git-credential-libsecret.c#L306-L311\n   * When I put the malicious URL in the test code shown in the\nCVE-2020-5260 patch into \"git-credential-libsecret\", it does not\nterminate.\n\nCould you please check whether this is an actual bug?\n\nThank you.\nBest regards,\nSeunghoon Woo\n-- \n\nBest regards,\n\nSeunghoon Woo\nKorea University Dept. of Computer Science and Engineering\nComputer & Communication Security Lab.\nseunghoonwoo@korea.ac.kr\n(+82)10-8147-9308\n"}]}