{"thread":{"id":"60714","subject":"Request fixing a vulnerability for git project","startedAt":"2024-01-10T06:47:25Z","lastAt":"2024-01-10T06:47:25Z","messageCount":1,"participants":["Reika Arakawa"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"486488","messageId":"TYYPR01MB671359306E4A73100356714EEF692@TYYPR01MB6713.jpnprd01.prod.outlook.com","threadId":"60714","inReplyTo":null,"subject":"Request fixing a vulnerability for git project","fromName":"Reika Arakawa","fromEmail":"reika.arakawa@ntt.com","sentAt":"2024-01-10T06:47:22Z","receivedAt":"2024-01-10T06:47:25Z","isPatch":false,"sender":{"key":"reika.arakawa@ntt.com","avatar":null},"body":"To Whom it May Concern: git Product Development Manager,\n\nWe are a cybersecurity research team affiliated with NTT in Japan, and are engaged in research related to vulnerability detection, analysis, and modification.\n\nWe investigated git (https://github.com/git/git) released as OSS. A known vulnerability and known code were found, so please fix them with a patch. We hope to prevent cyber-attacks from occurring by working together with Japan's representative, JPCERT/CC (vuls@jpcert.or.jp).\n\nHow to discover vulnerabilities:\nWe inspected all function codes for OSS software code using patch information and code information (2000-2023) for known vulnerabilities. We would like to inform you of the code information for which there is a high possibility that a public patch has not been applied with high severity. Vulnerability code information and countermeasures are listed in the attached file ‘git@@git_vulnerability_details.txt’.\nPlease note that in the real world, a vulnerable state may not necessarily be true, as it may become a vulnerable state under certain combinations of conditions in the real world.\n\n\nAdditional confirmation details:\nWe are planning to submit a paper on this content between January and March, and we would like to include the source code characteristics in the paper without revealing the OSS name or file name. Are there any concerns about this?\n\n\n--\nBest regards, NTT Social Informatics Laboratories（ https://www.rd.ntt/e/sil/）\nE-mail: reika.arakawa@ntt.com\n\n\n\nSoftware name：git@@git\nVersion tag：v2.43.0\n\nHow to fix: Search by CVE number, refer to the commit listed in reference on the NVD/CVE site, and fix it.\n\n\nNVD:https://nvd.nist.gov/vuln/detail/CVE-2009-5155\n\n\n\n① git@@git/compat/regex/regcomp.c [parse_reg_exp] \n\t・CVE-2009-5155，CWE-19_5.0_0\n\t・git.savannah.gnu.org##gnulib_regcomp.c, [parse_reg_exp]\n"}]}