git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 0/3] cvsserver: correctly validate pserver passwords

From
Carlo Marcelo Arenas Belón <carenas@gmail.com>
Date
Sep 15, 2021, 08:09 UTC
Message-ID
<20210915080948.11891-1-carenas@gmail.com>

The first patch should be applied by any user of git-cvsserver, and hashes for all pserver accounts updated; because the code originally was using the username instead of the password to validate accounts, and it might had even worked if the first 2 characters of the password where the same (ex: cvsuser/cvspassword).

The second one allows for successfully running t9400 in OpenBSD and will protect the code further from the possible use of an undef variable, and shows that support for better password hashes than DES is possible.

Carlo Marcelo Arenas Belón (3):
  git-cvsserver: use crypt correctly to compare password hashes
  git-cvsserver: protect against NULL in crypt(3)
  Documentation: cleanup git-cvsserver
 Documentation/git-cvsserver.txt | 27 +++++++++++++--------------
 git-cvsserver.perl              |  7 ++++---
 t/t9400-git-cvsserver-server.sh |  9 ++++++++-
 3 files changed, 25 insertions(+), 18 deletions(-)
-- 
2.33.0.481.g26d3bed244
Next: Carlo Marcelo Arenas Belón
Message 1 of 7 in “cvsserver: correctly validate pserver passwords”
  1. 0/3 cvsserver: correctly validate pserver passwordsCarlo Marcelo Arenas Belón, Sep 15, 2021
  2. 1/3 git-cvsserver: use crypt correctly to compare password hashesCarlo Marcelo Arenas Belón, Sep 15, 2021
  3. 2/3 git-cvsserver: protect against NULL in crypt(3)Carlo Marcelo Arenas Belón, Sep 15, 2021
  4. Junio C HamanoSep 16, 2021
  5. Carlo ArenasSep 16, 2021
  6. Junio C HamanoSep 17, 2021
  7. 3/3 Documentation: cleanup git-cvsserverCarlo Marcelo Arenas Belón, Sep 15, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.