# Possible bug reports for git-credential-libsecret

1 messages from 2022-03-09 to 2022-03-09. Participants: .
Thread: https://gitlist.dev/t/57526

## , 2022-03-09 17:53

Subject: Possible bug reports for git-credential-libsecret
Message-ID: <CAPb83E-1Ken14G9xdyw9MqZ6AiAZkwDuwRf_5NmqoUEvHcAqYQ@mail.gmail.com>
URL: https://gitlist.dev/e/CAPb83E-1Ken14G9xdyw9MqZ6AiAZkwDuwRf_5NmqoUEvHcAqYQ%40mail.gmail.com

```
Dear Git Development team

Hi.
Recently, I noted that the vulnerability patch (CVE-2020-5260) for
"git credential" is not applied in the "git-credential-libsecret"
program (./contrib/credential/libsecret/git-credential-libsecret.c).

Actually, I'm not sure whether "git-credential-libsecret" is actually
used. But it can be potentially intimidating, thus it would be good to
apply the same patch of "git credential" to
"git-credential-libsecret".

- Patch for CVE-2020-5260
   * https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b

- Similar but not patched code in "git-credential-libsecret"
   * https://github.com/git/git/blob/master/contrib/credential/libsecret/git-credential-libsecret.c#L306-L311
   * When I put the malicious URL in the test code shown in the
CVE-2020-5260 patch into "git-credential-libsecret", it does not
terminate.

Could you please check whether this is an actual bug?

Thank you.
Best regards,
Seunghoon Woo
-- 

Best regards,

Seunghoon Woo
Korea University Dept. of Computer Science and Engineering
Computer & Communication Security Lab.
seunghoonwoo@korea.ac.kr
(+82)10-8147-9308

```