!35 Fix CVE-2024-24577

From: @starlet-dx Reviewed-by: @cherry530 Signed-off-by: @cherry530
Fix CVE-2024-24577
2024-02-08 03:30:59 +00:00 · 2024-02-08 11:10:19 +08:00 · 2023-12-19 08:05:06 +00:00 · 2023-12-19 09:58:13 +08:00 · 2022-05-24 06:11:49 +00:00 · 2022-05-24 11:40:13 +08:00
6 changed files with 588 additions and 1 deletions
--- a/CVE-2020-12278.patch
+++ b/CVE-2020-12278.patch
@ -0,0 +1,44 @@
+From e1832eb20a7089f6383cfce474f213157f5300cb Mon Sep 17 00:00:00 2001
+From: Johannes Schindelin <johannes.schindelin@gmx.de>
+Date: Wed, 18 Sep 2019 16:33:18 +0200
+Subject: [PATCH] path: also guard `.gitmodules` against NTFS Alternate Data
+ Streams
+
+We just safe-guarded `.git` against NTFS Alternate Data Stream-related
+attack vectors, and now it is time to do the same for `.gitmodules`.
+
+Note: In the added regression test, we refrain from verifying all kinds
+of variations between short names and NTFS Alternate Data Streams: as
+the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it
+is enough to test one in order to know that all of them are guarded
+against.
+
+Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
+---
+ src/path.c          | 2 +-
+ tests/path/dotgit.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/path.c b/src/path.c
+index 7844da67227..b3a8fc32f83 100644
+--- a/src/path.c
+++ b/src/path.c
+@@ -1646,7 +1646,7 @@ GIT_INLINE(bool) only_spaces_and_dots(const char *path)
+ 	const char *c = path;
+ 
+ 	for (;; c++) {
+-		if (*c == '\0')
+		if (*c == '\0' || *c == ':')
+ 			return true;
+ 		if (*c != ' ' && *c != '.')
+ 			return false;
+diff --git a/tests/path/dotgit.c b/tests/path/dotgit.c
+index 30996694512..ceb7330d248 100644
+--- a/tests/path/dotgit.c
+++ b/tests/path/dotgit.c
+@@ -116,4 +116,5 @@ void test_path_dotgit__dotgit_modules_symlink(void)
+ 	cl_assert_equal_b(true, git_path_isvalid(NULL, ".gitmodules", 0, GIT_PATH_REJECT_DOT_GIT_HFS|GIT_PATH_REJECT_DOT_GIT_NTFS));
+ 	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_HFS));
+ 	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS));
+	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules . .::$DATA", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS));
+ }
--- a/CVE-2020-12279.patch
+++ b/CVE-2020-12279.patch
@ -0,0 +1,57 @@
+From 64c612cc3e25eff5fb02c59ef5a66ba7a14751e4 Mon Sep 17 00:00:00 2001
+From: Johannes Schindelin <johannes.schindelin@gmx.de>
+Date: Wed, 18 Sep 2019 15:25:02 +0200
+Subject: [PATCH] Protect against 8.3 "short name" attacks also on Linux/macOS
+
+The Windows Subsystem for Linux (WSL) is getting increasingly popular,
+in particular because it makes it _so_ easy to run Linux software on
+Windows' files, via the auto-mounted Windows drives (`C:\` is mapped to
+`/mnt/c/`, no need to set that up manually).
+
+Unfortunately, files/directories on the Windows drives can be accessed
+via their _short names_, if that feature is enabled (which it is on the
+`C:` drive by default).
+
+Which means that we have to safeguard even our Linux users against the
+short name attacks.
+
+Further, while the default options of CIFS/SMB-mounts seem to disallow
+accessing files on network shares via their short names on Linux/macOS,
+it _is_ possible to do so with the right options.
+
+So let's just safe-guard against short name attacks _everywhere_.
+
+Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
+---
+ src/checkout.c         | 2 +-
+ tests/checkout/nasty.c | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/checkout.c b/src/checkout.c
+index 5cfa7280baa..5b20ede466b 100644
+--- a/src/checkout.c
+++ b/src/checkout.c
+@@ -1271,7 +1271,7 @@ static int checkout_verify_paths(
+ 	int action,
+ 	git_diff_delta *delta)
+ {
+-	unsigned int flags = GIT_PATH_REJECT_WORKDIR_DEFAULTS;
+	unsigned int flags = GIT_PATH_REJECT_WORKDIR_DEFAULTS | GIT_PATH_REJECT_DOT_GIT_NTFS;
+ 
+ 	if (action & CHECKOUT_ACTION__REMOVE) {
+ 		if (!git_path_isvalid(repo, delta->old_file.path, delta->old_file.mode, flags)) {
+diff --git a/tests/checkout/nasty.c b/tests/checkout/nasty.c
+index 3897878cef1..a0ac738a812 100644
+--- a/tests/checkout/nasty.c
+++ b/tests/checkout/nasty.c
+@@ -206,9 +206,8 @@ void test_checkout_nasty__dot_git_dot(void)
+  */
+ void test_checkout_nasty__git_tilde1(void)
+ {
+-#ifdef GIT_WIN32
+ 	test_checkout_fails("refs/heads/git_tilde1", ".git/foobar");
+-#endif
+	test_checkout_fails("refs/heads/git_tilde1", "git~1/foobar");
+ }
+ 
+ /* A tree that contains an entry "git~2", when we have forced the short
--- a/CVE-2023-22742.patch
+++ b/CVE-2023-22742.patch
@ -0,0 +1,405 @@
+From: =?UTF-8?q?Carlos=20Mart=C3=ADn=20Nieto?= <carlosmn@github.com>
+Date: Tue, 1 Nov 2022 12:54:29 +0100
+Subject: [PATCH 1/1] Fix CVE-2023-22742
+Upstream(1.4.x): https://github.com/libgit2/libgit2/pull/6449
+Origin: https://build.opensuse.org/package/show/openSUSE:Leap:15.4/libgit2.28345
+
+---
+ src/transports/ssh.c | 324 +++++++++++++++++++++++++++++++++++++------
+ 1 files changed, 283 insertions(+), 41 deletions(-)
+
+diff --git a/src/transports/ssh.c b/src/transports/ssh.c
+index 23c6433..8098dda 100644
+--- a/src/transports/ssh.c
+++ b/src/transports/ssh.c
+@@ -473,15 +473,120 @@ static int request_creds(git_cred **out, ssh_subtransport *t, const char *user,
+ 	return 0;
+ }
+ 
+#define KNOWN_HOSTS_FILE ".ssh/known_hosts"
+
+/*
+ * Load the known_hosts file.
+ *
+ * Returns success but leaves the output NULL if we couldn't find the file.
+ */
+static int load_known_hosts(LIBSSH2_KNOWNHOSTS **hosts, LIBSSH2_SESSION *session)
+{
+	char *path = NULL;
+	const char *home;
+	LIBSSH2_KNOWNHOSTS *known_hosts = NULL;
+	int error;
+
+	assert(hosts);
+
+	home = getenv ("HOME");
+	if (!home)
+		return -1;
+	path = (char *) malloc (strlen (home) + strlen (KNOWN_HOSTS_FILE) + 2);
+	sprintf (path, "%s/%s", home, KNOWN_HOSTS_FILE);
+
+	if ((known_hosts = libssh2_knownhost_init(session)) == NULL) {
+		ssh_error(session, "error initializing known hosts");
+		error = -1;
+		goto out;
+	}
+
+	/*
+	 * Try to read the file and consider not finding it as not trusting the
+	 * host rather than an error.
+	 */
+	error = libssh2_knownhost_readfile(known_hosts, path, LIBSSH2_KNOWNHOST_FILE_OPENSSH);
+	if (error == LIBSSH2_ERROR_FILE)
+		error = 0;
+	if (error < 0)
+		ssh_error(session, "error reading known_hosts");
+
+out:
+	*hosts = known_hosts;
+
+	if (path)
+		free (path);
+
+	return error;
+}
+
+static const char *hostkey_type_to_string(int type)
+{
+	switch (type) {
+	case LIBSSH2_KNOWNHOST_KEY_SSHRSA:
+		return "ssh-rsa";
+	case LIBSSH2_KNOWNHOST_KEY_SSHDSS:
+		return "ssh-dss";
+#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_256
+	case LIBSSH2_KNOWNHOST_KEY_ECDSA_256:
+		return "ecdsa-sha2-nistp256";
+	case LIBSSH2_KNOWNHOST_KEY_ECDSA_384:
+		return "ecdsa-sha2-nistp384";
+	case LIBSSH2_KNOWNHOST_KEY_ECDSA_521:
+		return "ecdsa-sha2-nistp521";
+#endif
+#ifdef LIBSSH2_KNOWNHOST_KEY_ED25519
+	case LIBSSH2_KNOWNHOST_KEY_ED25519:
+		return "ssh-ed25519";
+#endif
+	}
+
+	return NULL;
+}
+
+/*
+ * We figure out what kind of key we want to ask the remote for by trying to
+ * look it up with a nonsense key and using that mismatch to figure out what key
+ * we do have stored for the host.
+ *
+ * Returns the string to pass to libssh2_session_method_pref or NULL if we were
+ * unable to find anything or an error happened.
+ */
+static const char *find_hostkey_preference(LIBSSH2_KNOWNHOSTS *known_hosts, const char *hostname, int port)
+{
+	struct libssh2_knownhost *host = NULL;
+	/* Specify no key type so we don't filter on that */
+	int type = LIBSSH2_KNOWNHOST_TYPE_PLAIN | LIBSSH2_KNOWNHOST_KEYENC_RAW;
+	const char key = '\0';
+	int error;
+
+	/*
+	 * In case of mismatch, we can find the type of key from known_hosts in
+	 * the returned host's information as it means that an entry was found
+	 * but our nonsense key obviously didn't match.
+	 */
+	error = libssh2_knownhost_checkp(known_hosts, hostname, port, &key, 1, type, &host);
+	if (error == LIBSSH2_KNOWNHOST_CHECK_MISMATCH)
+		return hostkey_type_to_string(host->typemask & LIBSSH2_KNOWNHOST_KEY_MASK);
+
+	return NULL;
+}
+
+ static int _git_ssh_session_create(
+ 	LIBSSH2_SESSION** session,
+	LIBSSH2_KNOWNHOSTS **hosts,
+	const char *hostname,
+	int port,
+ 	git_stream *io)
+ {
+ 	int rc = 0;
+ 	LIBSSH2_SESSION* s;
+	LIBSSH2_KNOWNHOSTS *known_hosts;
+ 	git_socket_stream *socket = (git_socket_stream *) io;
+	const char *keytype = NULL;
+ 
+ 	assert(session);
+	assert(hosts);
+ 
+ 	s = libssh2_session_init();
+ 	if (!s) {
+@@ -489,21 +594,181 @@ static int _git_ssh_session_create(
+ 		return -1;
+ 	}
+ 
+	if ((rc = load_known_hosts(&known_hosts, s)) < 0) {
+		ssh_error(s, "error loading known_hosts");
+		libssh2_session_free(s);
+		return -1;
+	}
+
+	if ((keytype = find_hostkey_preference(known_hosts, hostname, port)) != NULL) {
+		do {
+			rc = libssh2_session_method_pref(s, LIBSSH2_METHOD_HOSTKEY, keytype);
+		} while (LIBSSH2_ERROR_EAGAIN == rc || LIBSSH2_ERROR_TIMEOUT == rc);
+		if (rc != LIBSSH2_ERROR_NONE) {
+			ssh_error(s, "failed to set hostkey preference");
+			goto on_error;
+		}
+	}
+
+ 	do {
+ 		rc = libssh2_session_handshake(s, socket->s);
+ 	} while (LIBSSH2_ERROR_EAGAIN == rc || LIBSSH2_ERROR_TIMEOUT == rc);
+ 
+ 	if (rc != LIBSSH2_ERROR_NONE) {
+ 		ssh_error(s, "failed to start SSH session");
+-		libssh2_session_free(s);
+-		return -1;
+
+ 	}
+ 
+ 	libssh2_session_set_blocking(s, 1);
+ 
+ 	*session = s;
+	*hosts = known_hosts;
+ 
+ 	return 0;
+
+on_error:
+	libssh2_knownhost_free(known_hosts);
+	libssh2_session_free(s);
+	return -1;
+}
+
+/*
+ * Returns the typemask argument to pass to libssh2_knownhost_check{,p} based on
+ * the type of key that libssh2_session_hostkey returns.
+ */
+static int fingerprint_type_mask(int keytype)
+{
+	int mask = LIBSSH2_KNOWNHOST_TYPE_PLAIN | LIBSSH2_KNOWNHOST_KEYENC_RAW;
+	return mask;
+
+	switch (keytype) {
+	case LIBSSH2_HOSTKEY_TYPE_RSA:
+		mask |= LIBSSH2_KNOWNHOST_KEY_SSHRSA;
+		break;
+	case LIBSSH2_HOSTKEY_TYPE_DSS:
+		mask |= LIBSSH2_KNOWNHOST_KEY_SSHDSS;
+		break;
+#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_256
+	case LIBSSH2_HOSTKEY_TYPE_ECDSA_256:
+		mask |= LIBSSH2_KNOWNHOST_KEY_ECDSA_256;
+		break;
+	case LIBSSH2_HOSTKEY_TYPE_ECDSA_384:
+		mask |= LIBSSH2_KNOWNHOST_KEY_ECDSA_384;
+		break;
+	case LIBSSH2_HOSTKEY_TYPE_ECDSA_521:
+		mask |= LIBSSH2_KNOWNHOST_KEY_ECDSA_521;
+		break;
+#endif
+#ifdef LIBSSH2_HOSTKEY_TYPE_ED25519
+	case LIBSSH2_HOSTKEY_TYPE_ED25519:
+		mask |= LIBSSH2_KNOWNHOST_KEY_ED25519;
+		break;
+#endif
+	}
+
+	return mask;
+}
+
+/*
+ * Check the host against the user's known_hosts file.
+ *
+ * Returns 1/0 for valid/''not-valid or <0 for an error
+ */
+static int check_against_known_hosts(
+	LIBSSH2_SESSION *session,
+	LIBSSH2_KNOWNHOSTS *known_hosts,
+	const char *hostname,
+	int port,
+	const char *key,
+	size_t key_len,
+	int key_type)
+{
+	int check, typemask, ret = 0;
+	struct libssh2_knownhost *host = NULL;
+
+	if (known_hosts == NULL)
+		return 0;
+
+	typemask = fingerprint_type_mask(key_type);
+	check = libssh2_knownhost_checkp(known_hosts, hostname, port, key, key_len, typemask, &host);
+	if (check == LIBSSH2_KNOWNHOST_CHECK_FAILURE) {
+		ssh_error(session, "error checking for known host");
+		return -1;
+	}
+
+	ret = check == LIBSSH2_KNOWNHOST_CHECK_MATCH ? 1 : 0;
+
+	return ret;
+}
+
+/*
+ * Perform the check for the session's certificate against known hosts if
+ * possible and then ask the user if they have a callback.
+ *
+ * Returns 1/0 for valid/not-valid or <0 for an error
+ */
+static int check_certificate(
+	LIBSSH2_SESSION *session,
+	LIBSSH2_KNOWNHOSTS *known_hosts,
+	git_transport_certificate_check_cb check_cb,
+	void *check_cb_payload,
+	const char *host,
+	int port)
+{
+	git_cert_hostkey cert = {{ 0 }};
+	const char *key;
+	size_t cert_len;
+	int cert_type, cert_valid = 0, error = 0;
+
+	if ((key = libssh2_session_hostkey(session, &cert_len, &cert_type)) == NULL) {
+		ssh_error(session, "failed to retrieve hostkey");
+		return -1;
+	}
+
+	if ((cert_valid = check_against_known_hosts(session, known_hosts, host, port, key, cert_len, cert_type)) < 0)
+		return -1;
+
+	cert.parent.cert_type = GIT_CERT_HOSTKEY_LIBSSH2;
+	key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_SHA1);
+	if (key != NULL) {
+		cert.type |= GIT_CERT_SSH_SHA1;
+		memcpy(&cert.hash_sha1, key, 20);
+	}
+
+	key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_MD5);
+	if (key != NULL) {
+		cert.type |= GIT_CERT_SSH_MD5;
+		memcpy(&cert.hash_md5, key, 16);
+	}
+
+	if (cert.type == 0) {
+		giterr_set(GITERR_SSH, "unable to get the host key");
+		return -1;
+	}
+
+	giterr_clear();
+	error = 0;
+	if (!cert_valid) {
+		giterr_set(GITERR_SSH, "invalid or unknown remote ssh hostkey");
+		error = GIT_ECERTIFICATE;
+	}
+
+	if (check_cb != NULL) {
+		git_cert_hostkey *cert_ptr = &cert;
+		git_error_state previous_error = {0};
+
+		giterr_state_capture(&previous_error, error);
+		error = check_cb((git_cert *) cert_ptr, cert_valid, host, check_cb_payload);
+		if (error == GIT_PASSTHROUGH) {
+			error = giterr_state_restore(&previous_error);
+		} else if (error < 0 && !giterr_last()) {
+			giterr_set(GITERR_NET, "user canceled hostkey check");
+		}
+
+		giterr_state_free(&previous_error);
+	}
+
+	return error;
+ }
+ 
+ static int _git_ssh_setup_conn(
+@@ -514,12 +779,13 @@ static int _git_ssh_setup_conn(
+ {
+ 	char *host=NULL, *port=NULL, *path=NULL, *user=NULL, *pass=NULL;
+ 	const char *default_port="22";
+-	int auth_methods, error = 0;
+	int auth_methods, error = 0, port_num;
+ 	size_t i;
+ 	ssh_stream *s;
+ 	git_cred *cred = NULL;
+ 	LIBSSH2_SESSION* session=NULL;
+ 	LIBSSH2_CHANNEL* channel=NULL;
+	LIBSSH2_KNOWNHOSTS *known_hosts = NULL;
+ 
+ 	t->current_stream = NULL;
+ 
+@@ -551,46 +817,20 @@ post_extract:
+ 	    (error = git_stream_connect(s->io)) < 0)
+ 		goto done;
+ 
+-	if ((error = _git_ssh_session_create(&session, s->io)) < 0)
+-		goto done;
+-
+-	if (t->owner->certificate_check_cb != NULL) {
+-		git_cert_hostkey cert = {{ 0 }}, *cert_ptr;
+-		const char *key;
+-
+-		cert.parent.cert_type = GIT_CERT_HOSTKEY_LIBSSH2;
+-
+-		key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_SHA1);
+-		if (key != NULL) {
+-			cert.type |= GIT_CERT_SSH_SHA1;
+-			memcpy(&cert.hash_sha1, key, 20);
+-		}
+-
+-		key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_MD5);
+-		if (key != NULL) {
+-			cert.type |= GIT_CERT_SSH_MD5;
+-			memcpy(&cert.hash_md5, key, 16);
+-		}
+-
+-		if (cert.type == 0) {
+-			giterr_set(GITERR_SSH, "unable to get the host key");
+-			error = -1;
+-			goto done;
+-		}
+-
+-		/* We don't currently trust any hostkeys */
+-		giterr_clear();
+-
+-		cert_ptr = &cert;
+	/*
+	 * Try to parse the port as a number, if we can't then fall back to
+	 * default. It would be nice if we could get the port that was resolved
+	 * as part of the stream connection, but that's not something that's
+	 * exposed.
+	 */
+	if (git__strntol32(&port_num, port, strlen(port), NULL, 10) < 0)
+		port_num = -1;
+ 
+-		error = t->owner->certificate_check_cb((git_cert *) cert_ptr, 0, host, t->owner->message_cb_payload);
+-		if (error < 0) {
+-			if (!giterr_last())
+-				giterr_set(GITERR_NET, "user cancelled hostkey check");
+	if ((error = _git_ssh_session_create(&session, &known_hosts, host, port, s->io)) < 0)
+		goto done;
+ 
+-			goto done;
+-		}
+-	}
+	if ((error = check_certificate(session, known_hosts, t->owner->certificate_check_cb, t->owner->message_cb_payload, host, port)) < 0)
+		goto done;
+ 
+ 	/* we need the username to ask for auth methods */
+ 	if (!user) {
+@@ -654,6 +894,8 @@ done:
+ 	if (error < 0) {
+ 		ssh_stream_free(*stream);
+ 
+		if (known_hosts)
+			libssh2_knownhost_free(known_hosts);
+ 		if (session)
+ 			libssh2_session_free(session);
+ 	}
+-- 
+2.33.0
+
--- a/CVE-2024-24577.patch
+++ b/CVE-2024-24577.patch
@ -0,0 +1,47 @@
+From eb4c1716cd92bf56f2770653a915d5fc01eab8f3 Mon Sep 17 00:00:00 2001
+From: Edward Thomson <ethomson@edwardthomson.com>
+Date: Sat, 16 Dec 2023 11:19:07 +0000
+Subject: [PATCH] index: correct index has_dir_name check
+
+`has_dir_name` is used to check for directory/file collisions,
+and attempts to determine whether the index contains a file with
+a directory name that is a proper subset of the new index entry
+that we're trying to add.
+
+To determine directory name, the function would walk the path string
+backwards to identify a `/`, stopping at the end of the string. However,
+the function assumed that the strings did not start with a `/`. If the
+paths contain only a single `/` at the beginning of the string, then the
+function would continue the loop, erroneously, when they should have
+stopped at the first character.
+
+Correct the order of the tests to terminate properly.
+
+Credit to Michael Rodler (@f0rki) and Amazon AWS Security.
+---
+ src/index.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/index.c b/src/index.c
+index 2b47e4d..80fa544 100644
+--- a/src/index.c
+++ b/src/index.c
+@@ -1114,10 +1114,13 @@ static int has_dir_name(git_index *index,
+ 		size_t len, pos;
+ 
+ 		for (;;) {
+-			if (*--slash == '/')
+-				break;
+			slash--;
+
+ 			if (slash <= entry->path)
+ 				return retval;
+
+			if (*slash == '/')
+				break;
+ 		}
+ 		len = slash - name;
+ 
+-- 
+2.33.0
+
--- a/Remove-error-prone-redundant-test.patch
+++ b/Remove-error-prone-redundant-test.patch
@ -0,0 +1,13 @@
+diff --git a/tests/refs/revparse.c b/tests/refs/revparse.c
+index 459188c..2bb19ff 100644
+--- a/tests/refs/revparse.c
+++ b/tests/refs/revparse.c
+@@ -400,8 +400,6 @@ void test_refs_revparse__date(void)
+ 	 * a65fedf HEAD@{1335806603 -0900}: commit:
+ 	 * be3563a HEAD@{1335806563 -0700}: clone: from /Users/ben/src/libgit2/tests/resour
+ 	 */
+-	test_object("HEAD@{10 years ago}", NULL);
+-
+ 	test_object("HEAD@{1 second}", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750");
+ 	test_object("HEAD@{1 second ago}", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750");
+ 	test_object("HEAD@{2 days ago}", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750");
--- a/libgit2.spec
+++ b/libgit2.spec
@ -1,12 +1,18 @@
 Name:           libgit2
 Version:        0.27.8
-Release:        3
+Release:        8
 Summary:        portable, pure C implementation of the Git core methods
 License:        GPLv2 with exceptions
 URL:            https://libgit2.org
 Source0:        https://github.com/libgit2/libgit2/archive/v%{version}.tar.gz

 Patch0001:      0001-tests-don-t-run-buf-oom-on-32-bit-systems.patch
+Patch0002:      CVE-2020-12278.patch
+Patch0003:      CVE-2020-12279.patch
+Patch0004:      Remove-error-prone-redundant-test.patch
+Patch0005:      CVE-2023-22742.patch
+# https://github.com/libgit2/libgit2/commit/eb4c1716cd92bf56f2770653a915d5fc01eab8f3
+Patch0006:      CVE-2024-24577.patch

 BuildRequires:  gcc cmake >= 2.8.11 ninja-build http-parser-devel libcurl-devel
 BuildRequires:  libssh2-devel openssl-devel python3 zlib-devel
@ -55,6 +61,21 @@ sed -i '/ADD_TEST(online/s/^/#/' tests/CMakeLists.txt
 %{_includedir}/git2*

 %changelog
+* Thu Feb 08 2024 yaoxin <yao_xin001@hoperun.com> - 0.27.8-8
+- Fix CVE-2024-24577
+
+* Thu Dec 14 2023 wangkai <13474090681@163.com> - 0.27.8-7
+- Fix CVE-2023-22742
+
+* Tue May 24 2022 liyanan <liyanan32@h-partners.com> - 0.27.8-6
+- Remove error-prone, redundant test
+
+* Fri Jul 23 2021 guoxiaoqi<guoxiaoqi2@huawei.com> - 0.27.8-5
+- fix CVE-2020-12278 and CVE-2020-12279
+
+* Mon May 18 2020 zhouyihang<zhouyihang3@huawei.com> - 0.27.8-4
+- Rebuild for libgit2
+
 * Thu Jan 16 2020 yangjian<yangjian79@huawei.com> - 0.27.8-3
 - Change the Source to valid address
Author	SHA1	Message	Date
openeuler-ci-bot	d1c58dd209	!35 Fix CVE-2024-24577 From: @starlet-dx Reviewed-by: @cherry530 Signed-off-by: @cherry530	2024-02-08 03:30:59 +00:00
starlet-dx	546bec7511	Fix CVE-2024-24577	2024-02-08 11:10:19 +08:00
openeuler-ci-bot	e315708a0b	!30 [sync] PR-26: Fix CVE-2023-22742 From: @openeuler-sync-bot Reviewed-by: @caodongxia Signed-off-by: @caodongxia	2023-12-19 08:05:06 +00:00
wk333	c185be60ba	Fix CVE-2023-22742 (cherry picked from commit d523dd3596f3190c29fb612752f947b6d5a16b9a)	2023-12-19 09:58:13 +08:00
openeuler-ci-bot	14be6cd5a1	!19 Remove error-prone, redundant test From: @lyn1001 Reviewed-by: @licihua Signed-off-by: @licihua	2022-05-24 06:11:49 +00:00
lyn1001	665a30ac8d	Remove error prone redundant test	2022-05-24 11:40:13 +08:00
openeuler-ci-bot	f8866bac27	!12 fix CVE-2020-12278 and CVE-2020-12279 From: @angela7 Reviewed-by: @overweight Signed-off-by: @overweight	2021-07-23 06:26:34 +00:00
guoxiaoqi	f98b663154	fix CVE-2020-12278 and CVE-2020-12279	2021-07-23 10:03:27 +08:00
openeuler-ci-bot	7a2ed2024e	!6 Rebuild for libgit2 Merge pull request !6 from sherlock2010/openEuler-20.03-LTS	2020-05-20 09:31:49 +08:00
sherlock2010	5fbe06c2e3	Rebuild for libgit2	2020-05-18 19:24:05 +08:00