apticron report [Sat, 02 Jun 2018 22:38:06 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
git 1:2.11.0-3+deb9u3
git-man 1:2.11.0-3+deb9u3
gitweb 1:2.11.0-3+deb9u3
========================================================================
Package Details:
apt-listchanges : Lecture des fichiers de modifications (« changelog »)...
apt-listchanges : journaux des modifications (« changelogs »)
-------------------------------------------------------------
--- Modifications pour git (git git-man gitweb) ---
git (1:2.11.0-3+deb9u3) stretch-security; urgency=high
* Fix CVE-2018-11235, arbitrary code execution via submodule names
in .gitmodules file:
- submodule: verify submodule names as paths
- fsck: simplify ".git" check
- fsck: fsck blob data
- fsck: detect .gitmodules files
- fsck: check .gitmodules content
- fsck: call fsck_finish after fscking objects
- unpack-objects: call fsck_finish after fscking objects
- index-pack: check .gitmodules files with --strict
* Fix CVE-2018-11233, out-of-bounds read when validing NTFS paths:
- is_ntfs_dotgit: use a size_t for traversing string
* Do not allow .gitmodules to be a symlink:
- is_hfs_dotgit: match other .git* files
- is_ntfs_dotgit: match other .git* files
- is_{hfs,ntfs}_dotgitmodules: add tests
- skip_prefix: add case-insensitive variant
- verify_path: drop clever fallthrough
- verify_dotfile: mention case-insensitivity in comment
- update-index: stat updated files earlier
- verify_path: disallow .gitmodules symlinks
- fsck: complain when .gitmodules is a symlink
* debian/rules: make the new test executable.
Thanks to Brandon Williams, Etienne Stalmans, and Jeff King for
discovering and reporting these vulnerabilities and to Jeff King
and Johannes Schindelin for fixing them.
-- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 27 May 2018 10:48:46 -0700
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron
This is the mail system at host nonagon.crans.org.
I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can
delete your own text from the attached returned message.
The mail system
<monitoring(a)federez.net> (expanded from <root>): host
smtp.crans.org[2a0c:700:0:1:200:9ff:fe04:1901] said: 550 5.1.0
<root(a)nonagon.crans.org>: Sender address rejected: User unknown in relay
recipient table (in reply to RCPT TO command)
apticron report [Fri, 01 Jun 2018 22:38:04 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
git 1:2.11.0-3+deb9u3
git-man 1:2.11.0-3+deb9u3
gitweb 1:2.11.0-3+deb9u3
========================================================================
Package Details:
apt-listchanges : Lecture des fichiers de modifications (« changelog »)...
apt-listchanges : journaux des modifications (« changelogs »)
-------------------------------------------------------------
--- Modifications pour git (git git-man gitweb) ---
git (1:2.11.0-3+deb9u3) stretch-security; urgency=high
* Fix CVE-2018-11235, arbitrary code execution via submodule names
in .gitmodules file:
- submodule: verify submodule names as paths
- fsck: simplify ".git" check
- fsck: fsck blob data
- fsck: detect .gitmodules files
- fsck: check .gitmodules content
- fsck: call fsck_finish after fscking objects
- unpack-objects: call fsck_finish after fscking objects
- index-pack: check .gitmodules files with --strict
* Fix CVE-2018-11233, out-of-bounds read when validing NTFS paths:
- is_ntfs_dotgit: use a size_t for traversing string
* Do not allow .gitmodules to be a symlink:
- is_hfs_dotgit: match other .git* files
- is_ntfs_dotgit: match other .git* files
- is_{hfs,ntfs}_dotgitmodules: add tests
- skip_prefix: add case-insensitive variant
- verify_path: drop clever fallthrough
- verify_dotfile: mention case-insensitivity in comment
- update-index: stat updated files earlier
- verify_path: disallow .gitmodules symlinks
- fsck: complain when .gitmodules is a symlink
* debian/rules: make the new test executable.
Thanks to Brandon Williams, Etienne Stalmans, and Jeff King for
discovering and reporting these vulnerabilities and to Jeff King
and Johannes Schindelin for fixing them.
-- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 27 May 2018 10:48:46 -0700
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron
This is the mail system at host nonagon.crans.org.
I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can
delete your own text from the attached returned message.
The mail system
<monitoring(a)federez.net> (expanded from <root>): host
smtp.crans.org[2a0c:700:0:1:200:9ff:fe04:1901] said: 550 5.1.0
<root(a)nonagon.crans.org>: Sender address rejected: User unknown in relay
recipient table (in reply to RCPT TO command)