{"thread":{"id":"57942","subject":"CVE-2022-24975","startedAt":"2022-06-01T20:55:56Z","lastAt":"2022-06-06T15:11:18Z","messageCount":4,"participants":["Mark Esler","Junio C Hamano","Dyer, Edwin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"456468","messageId":"CAJ=HsVKX-NXePKU1G0UKRcFT5He8AjS_TQEirb3hN3chGFz9TA@mail.gmail.com","threadId":"57942","inReplyTo":null,"subject":"CVE-2022-24975","fromName":"Mark Esler","fromEmail":"mark.esler@canonical.com","sentAt":"2022-06-01T20:55:09Z","receivedAt":"2022-06-01T20:55:56Z","isPatch":false,"sender":{"key":"mark.esler@canonical.com","avatar":null},"body":"Hello,\n\nCould the git developers state their position on CVE-2022-24975? Is it\ndisputed or will it be addressed by upstream?\n\nAs I read the documentation, --mirror is working as stated and MITRE\nshould remove the CVE.\n\nThank you,\nMark Esler\n"},{"id":"456469","messageId":"xmqq4k14qe9g.fsf@gitster.g","threadId":"57942","inReplyTo":"CAJ=HsVKX-NXePKU1G0UKRcFT5He8AjS_TQEirb3hN3chGFz9TA@mail.gmail.com","subject":"Re: CVE-2022-24975","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-06-01T21:12:43Z","receivedAt":"2022-06-01T21:12:50Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Mark Esler writes:\n\n> Hello,\n>\n> Could the git developers state their position on CVE-2022-24975? Is it\n> disputed or will it be addressed by upstream?\n>\n> As I read the documentation, --mirror is working as stated and MITRE\n> should remove the CVE.\n>\n> Thank you,\n> Mark Esler\n\nIt took me a while to Google for \"gitbleed\" as I got tons of GI\nbleed but no Gitbleed, so a quick conclusion is there is no such\ncredible thing called gitbleed ;-)\n\nJokes aside (yes, I know about [*]).\n\nAs you said, \"A repository can have more than what branch heads and\ntags can reach, and the --mirror option is a way to copy all the\nthings that are reachable from other refs. It is 100% working as\nintended.\"\n\nDuring the discussion about [*] on git-security@ mailing lsit,\neverybody said that it is dubious that CVE is warranted. I am not\nsure there is anything more for us to do.\n\n\n[Reference]\n\n* https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/\n\n the author of which asked git-security@ list and after getting\n things explained, accepted that this is a \"working as intended\"\n functionality and promised to adjust the blog post entry not to\n imply that the entire repository can be copied. I do not know how\n much correction was actually made since then, though.\n"},{"id":"456471","messageId":"CAJ=HsV+DEP6WqyBpQq8ACsMM-KixN9-JRAMXNjML8AcjWosChA@mail.gmail.com","threadId":"57942","inReplyTo":"xmqq4k14qe9g.fsf@gitster.g","subject":"Re: CVE-2022-24975","fromName":"Mark Esler","fromEmail":"mark.esler@canonical.com","sentAt":"2022-06-01T21:40:09Z","receivedAt":"2022-06-01T21:40:28Z","isPatch":false,"sender":{"key":"mark.esler@canonical.com","avatar":null},"body":"Thanks Junio!\n"},{"id":"456715","messageId":"DM6PR01MB597862CFD285C837EA61E690F9A29@DM6PR01MB5978.prod.exchangelabs.com","threadId":"57942","inReplyTo":"xmqq4k14qe9g.fsf@gitster.g","subject":"RE: CVE-2022-24975","fromName":"Dyer, Edwin","fromEmail":"edwin.dyer@breadfinancial.com","sentAt":"2022-06-06T15:11:09Z","receivedAt":"2022-06-06T15:11:18Z","isPatch":false,"sender":{"key":"edwin.dyer@breadfinancial.com","avatar":null},"body":"Greetings:\n\nIf it helps, Qualys isn't flagging this CVE as we use Git in several versions. I checked our main Git box and nary a flag for it.\n\nEd Dyer\nDevOps Engineer\n\nMalum Consilium Quod Mutari Non Potest\n\n-----Original Message-----\nFrom: Junio C Hamano \nSent: Wednesday, June 1, 2022 5:13 PM\nTo: Mark Esler \nCc: git@vger.kernel.org\nSubject: Re: CVE-2022-24975\n\n[EXTERNAL EMAIL] – Think Security!\n\nMark Esler writes:\n\n> Hello,\n>\n> Could the git developers state their position on CVE-2022-24975? Is it \n> disputed or will it be addressed by upstream?\n>\n> As I read the documentation, --mirror is working as stated and MITRE \n> should remove the CVE.\n>\n> Thank you,\n> Mark Esler\n\nIt took me a while to Google for \"gitbleed\" as I got tons of GI bleed but no Gitbleed, so a quick conclusion is there is no such credible thing called gitbleed ;-)\n\nJokes aside (yes, I know about [*]).\n\nAs you said, \"A repository can have more than what branch heads and tags can reach, and the --mirror option is a way to copy all the things that are reachable from other refs. It is 100% working as intended.\"\n\nDuring the discussion about [*] on git-security@ mailing lsit, everybody said that it is dubious that CVE is warranted. I am not sure there is anything more for us to do.\n\n\n[Reference]\n\n* https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/\n\n the author of which asked git-security@ list and after getting\n things explained, accepted that this is a \"working as intended\"\n functionality and promised to adjust the blog post entry not to\n imply that the entire repository can be copied. I do not know how\n much correction was actually made since then, though.\n\n______________________________________________________________________\nThe information contained in this e-mail message and any attachments may be privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this e-mail and delete the message and any attachments from your computer.\n______________________________________________________________________\n"}]}