[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: open security issues in the git packages

On 2023-01-18 23:34:37 +0000 (UTC), Thorsten Glaser wrote:
> The versions in Debian and *buntu don’t exactly match, but perhaps
> appropriate patches for the respective versions are available, or
> they apply with little fuzz?

Just a data point around this, I spent a good chunk of yesterday
porting Ubuntu's 22-patch series for CVE-2022-23521 and
CVE-2022-41903 from the 1:2.25.1-1ubuntu3.7 package in focal-updates
to the 1:2.30.2-1 in bullseye. The only patch my colleagues and I
found which needed adjustment was 0012, and for that I was able to
apply upstream commit 3c50032 directly instead.
Jeremy Stanley

Attachment: signature.asc
Description: PGP signature

Reply to: