diff options
| author | Simon McVittie <smcv@debian.org> | 2016-12-19 13:48:56 +0000 |
|---|---|---|
| committer | Simon McVittie <smcv@debian.org> | 2016-12-28 21:32:12 +0000 |
| commit | a8a7462382ff235086743f06a92a9ab9100083b4 (patch) | |
| tree | 0d69d59b5c84950aa17f8ca08df4bc5ba4f1118c /doc | |
| parent | 469c842fd56ce811d431058714d9c2700a5314f8 (diff) | |
| download | ikiwiki-a8a7462382ff235086743f06a92a9ab9100083b4.tar ikiwiki-a8a7462382ff235086743f06a92a9ab9100083b4.tar.gz | |
Try revert operations (on a branch) before approving them
Otherwise, we have a time-of-check/time-of-use vulnerability:
rcs_preprevert previously looked at what changed in the commit we are
reverting, not at what would result from reverting it now. In
particular, if some files were renamed since the commit we are
reverting, a revert of changes that were within the designated
subdirectory and allowed by check_canchange() might now affect
files that are outside the designated subdirectory or disallowed
by check_canchange().
It is not sufficient to disable rename detection, since git older
than 2.8.0rc0 (in particular the version in Debian stable) silently
accepts and ignores the relevant options.
OVE-20161226-0002
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/security.mdwn | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 9818e0c94..c08d658c8 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -561,8 +561,12 @@ result in `policy.mdwn` being altered. This affects sites with the `git` VCS and the `recentchanges` plugin, which are both used in most ikiwiki installations. -This bug was reported on 2016-12-17. The fixed version 3.20161219 -was released on 2016-12-19. ([[!cve CVE-2016-10026]]) +This bug was reported on 2016-12-17. A partially fixed version +3.20161219 was released on 2016-12-19, but the solution used in that +version was not effective with git versions older than 2.8.0. + +([[!cve CVE-2016-10026]] represents the original vulnerability. +OVE-20161226-0002 represents the incomplete fix in 3.20161219.) ## Commit metadata forgery via CGI::FormBuilder context-dependent APIs |