Regarding the recent discovery of a vulnerability in git

[thomasmu...@yahoo.com]

Hi, im wondering is jgit affected by https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ ?

[Jonathan Nieder]

Hi,

Another link is at https://public-inbox.org/git/xmqqy3g2...@gitster-ct.c.googlers.com/.

At https://bugs.eclipse.org/535027 we found that JGit names directories in .git/modules/ after the submodule path instead of the submodule name. That's itself a bug, but it makes JGit not vulnerable, since paths in a Git tree object cannot contain a .. component.

Jonathan

вт, 29 мая 2018 г. в 16:45, thomasmulhall410 via Repo and Gerrit Discussion <repo-d...@googlegroups.com>:

Hi, im wondering is jgit affected by https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ ?

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[thomasmu...@yahoo.com]

Will jgit be updated in 2.14, 2.15 and master?

[Jonathan Nieder]

What update do you have in mind? Would you mind commenting in Eclipse bugzilla with more detail?

вт, 29 мая 2018 г. в 16:59, thomasmulhall410 via Repo and Gerrit Discussion <repo-d...@googlegroups.com>:

Will jgit be updated in 2.14, 2.15 and master?

On Wednesday, May 30, 2018 at 12:45:37 AM UTC+1, thomasmu...@yahoo.com wrote:

Hi, im wondering is jgit affected by https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ ?

--

[thomasmu...@yahoo.com]

Oh, re reading https://bugs.eclipse.org/bugs/show_bug.cgi?id=535027 it shows that jgit is not affected, nvm.

though there's this only change https://git.eclipse.org/r/c/123252/ link from there.