threads / discuss / 38064

Where is the best place to report a security vulnerability in git?

Subject: Where is the best place to report a security vulnerability in git?

## tl;dr

4 messages between Nov 27, 2014 and Nov 27, 2014.

replies: 3people: 3as markdown or json

Hugh Davenport· Nov 27, 2014, 00:49 UTC · lore

Jonathan Nieder· Nov 27, 2014, 01:20 UTC · re: Hugh Davenport · lore

Re: Where is the best place to report a security vulnerability in git?

Hi Hugh,

Hugh Davenport wrote:

> Where is the best place to report a security vulnerability in git?

Current practice is to contact Junio C Hamano <gitster@pobox.com>. Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.

We should probably set up a mailing list to make this more obvious, but that's what we have today.

Thanks, Jonathan

Hugh Davenport· Nov 27, 2014, 02:04 UTC · re: Jonathan Nieder · lore

Re: Where is the best place to report a security vulnerability in git?

Thanks. Will send a report their way soon

On 27 November 2014 2:20:53 pm NZDT, Jonathan Nieder <jrnieder@gmail.com> wrote:

Show 14 quoted lines

>Hi Hugh,
>
>Hugh Davenport wrote:
>
>> Where is the best place to report a security vulnerability in git?
>
>Current practice is to contact Junio C Hamano <gitster@pobox.com>.
>Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.
>
>We should probably set up a mailing list to make this more obvious,
>but that's what we have today.
>
>Thanks,
>Jonathan

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Sitaram Chamarty· Nov 27, 2014, 03:32 UTC · re: Jonathan Nieder · lore

Re: Where is the best place to report a security vulnerability in git?

On 11/27/2014 06:50 AM, Jonathan Nieder wrote:

Show 11 quoted lines

> Hi Hugh,
> 
> Hugh Davenport wrote:
> 
>> Where is the best place to report a security vulnerability in git?
> 
> Current practice is to contact Junio C Hamano <gitster@pobox.com>.
> Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.
> 
> We should probably set up a mailing list to make this more obvious,
> but that's what we have today.

Hi Hugh,

I maintain a somewhat widely used access control program for remote access to git, so I'm interested also.

Gitolite [1] and similar systems provide access control for git repos. There's a very good chance that something which is not a concern for "local" use, could become an attack vector if enabled through gitolite.

Hence my interest, and my request that I be copied.

Jonathan/Junio/Jeff: if such a mailing list does happen please consider adding me into it.

regards sitaram

[1]: https://gitolite.com