git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Where is the best place to report a security vulnerability in git?

From
Sitaram Chamarty <sitaramc@gmail.com>
Date
Nov 27, 2014, 03:32 UTC
Message-ID
<54769B38.30708@gmail.com>
In-Reply-To
<20141127012053.GU6527@google.com>
On 11/27/2014 06:50 AM, Jonathan Nieder wrote:
Show 11 quoted lines
> Hi Hugh,
> 
> Hugh Davenport wrote:
> 
>> Where is the best place to report a security vulnerability in git?
> 
> Current practice is to contact Junio C Hamano <gitster@pobox.com>.
> Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.
> 
> We should probably set up a mailing list to make this more obvious,
> but that's what we have today.
Hi Hugh,

I maintain a somewhat widely used access control program for remote access to git, so I'm interested also.

Gitolite [1] and similar systems provide access control for git repos. There's a very good chance that something which is not a concern for "local" use, could become an attack vector if enabled through gitolite.

Hence my interest, and my request that I be copied.

Jonathan/Junio/Jeff: if such a mailing list does happen please consider adding me into it.

regards sitaram

[1]: https://gitolite.com
Previous: Hugh Davenport
Message 4 of 4 in “Where is the best place to report a security vulnerability in git?”
  1. Hugh DavenportNov 27, 2014
  2. Jonathan NiederNov 27, 2014
  3. Hugh DavenportNov 27, 2014
  4. Sitaram ChamartyNov 27, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.