# Re: Potential vulnerability: 'mixed up' output when commit has multiple signatures

2 messages from 2018-08-15 to 2018-08-15. Participants: Jonathan Nieder, Michał Górny.
Thread: https://gitlist.dev/t/49139

## Jonathan Nieder, 2018-08-15 21:20

Subject: Re: Potential vulnerability: 'mixed up' output when commit has multiple signatures
Message-ID: <20180815212009.GE181377@aiede.svl.corp.google.com>
URL: https://gitlist.dev/e/20180815212009.GE181377%40aiede.svl.corp.google.com
In-Reply-To: <1534315421.1603.0.camel@gentoo.org>

```
Michał Górny wrote:
> On Tue, 2018-08-14 at 22:35 -0700, Jonathan Nieder wrote:
> > Michał Górny wrote:

>>> I've been testing the git signature verification a bit and I've
>>> discovered a troubling behavior when the commit object contains
>>> multiple signatures.
>>
>> Thanks for discovering this.  Do you mind if I take this conversation
>> to the public mailing list?  (I'd bounce the existing thread there if
>> that's okay with you.)
>
> I've already asked somewhere else in the thread if you consider this
> suitable for disclosure, and haven't received a reply yet.  In any case,
> I don't mind it.

Thanks, doing so.

Thanks again for the analysis and fix as well.

```

## Michał Górny, 2018-08-15 06:43

Subject: Re: Potential vulnerability: 'mixed up' output when commit has multiple signatures
Message-ID: <1534315421.1603.0.camel@gentoo.org>
URL: https://gitlist.dev/e/1534315421.1603.0.camel%40gentoo.org
In-Reply-To: <20180815053522.GI32543@aiede.svl.corp.google.com>

```
On Tue, 2018-08-14 at 22:35 -0700, Jonathan Nieder wrote:
> Hi,
> 
> Michał Górny wrote:
> 
> > I've been testing the git signature verification a bit and I've
> > discovered a troubling behavior when the commit object contains
> > multiple signatures.
> 
> Thanks for discovering this.  Do you mind if I take this conversation
> to the public mailing list?  (I'd bounce the existing thread there if
> that's okay with you.)
> 

I've already asked somewhere else in the thread if you consider this
suitable for disclosure, and haven't received a reply yet.  In any case,
I don't mind it.  I can resend my patch there if necessary too.

-- 
Best regards,
Michał Górny

```