CVE-2021-21300 (was: Re: Accepted git 1:2.30.2-1 (source) into unstable)

Related Vulnerabilities: CVE-2021-21300  

Debian Bug report logs - #985120
CVE-2021-21300 (was: Re: Accepted git 1:2.30.2-1 (source) into unstable)

version graph

Package: git; Maintainer for git is Jonathan Nieder <jrnieder@gmail.com>; Source for git is src:git (PTS, buildd, popcon).

Reported by: Jonathan Nieder <jrnieder@gmail.com>

Date: Sat, 13 Mar 2021 02:24:01 UTC

Severity: important

Tags: security, upstream

Found in versions git/1:2.20.1-2+deb10u3, git/1:2.20.1-1

Fixed in version git/1:2.30.2-1

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org:
Bug#985120; Package git. (Sat, 13 Mar 2021 02:24:03 GMT) (full text, mbox, link).


Acknowledgement sent to Jonathan Nieder <jrnieder@gmail.com>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org. (Sat, 13 Mar 2021 02:24:19 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jonathan Nieder <jrnieder@gmail.com>
To: submit@bugs.debian.org
Subject: CVE-2021-21300 (was: Re: Accepted git 1:2.30.2-1 (source) into unstable)
Date: Fri, 12 Mar 2021 18:21:27 -0800
Package: git
Version: 1:2.20.1-2+deb10u3
Severity: important
Justification: security issue
Tags: upstream security

Salvatore Bonaccorso wrote:
> On Wed, Mar 10, 2021 at 02:21:05AM +0000, Debian FTP Masters wrote:

>>    * new upstream point release (see RelNotes/2.30.2.txt).
>
> This adresses CVE-2021-21300. IMHO this though does not warrant a DSA,
> but can you consider fixing it in the next point release and contact
> the stable release managers?
>
> Do you concur?

Yes, hence filing a bug.



Marked as fixed in versions git/1:2.30.2-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 13 Mar 2021 19:45:13 GMT) (full text, mbox, link).


Marked as found in versions git/1:2.20.1-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 13 Mar 2021 20:12:03 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Mar 14 23:16:02 2021; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.