Fedora 27: 2018-821be0e60d Severe: Git Remote Abuse Vulnerability

Git is a fast, scalable, distributed revision control system with an

unusually rich command set that provides both high-level operations

and full access to internals.

The git rpm installs common set of tools which are usually using with

small amount of dependencies. To install all git packages, including

tools for integrating with other SCMs, install the git-all meta-package.

Previous versions of git mishandled layers of tree objects, which allowed remote

attackers to cause a denial of service (memory consumption) via a crafted

repository, aka a git bomb. This can also have an impact of disk consumption;

however, an affected process typically would not survive its attempt to build

the data structure in memory before writing to disk.

[ 1 ] Bug #1510457 - CVE-2017-15298 git: Mishandling layers of tree objects [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1510457

su -c 'dnf upgrade git' at the command line.

For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org