From 069d9186594f085784f836ec6076971414512f87994e2628ff64ba598da4d257 Mon Sep 17 00:00:00 2001
From: Dominique Leuenberger <dleuenberger@suse.com>
Date: Mon, 21 Aug 2017 09:35:00 +0000
Subject: [PATCH] Accepting request 515991 from devel:tools:scm

git 2.14.1 (bsc#1052481) CVE-2017-1000117

OBS-URL: https://build.opensuse.org/request/show/515991
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/git?expand=0&rev=202
---
 git-2.14.0.tar.sign | Bin 543 -> 0 bytes
 git-2.14.0.tar.xz   |   3 ---
 git-2.14.1.tar.sign | Bin 0 -> 543 bytes
 git-2.14.1.tar.xz   |   3 +++
 git.changes         |  25 +++++++++++++++++++++++++
 git.spec            |   2 +-
 6 files changed, 29 insertions(+), 4 deletions(-)
 delete mode 100644 git-2.14.0.tar.sign
 delete mode 100644 git-2.14.0.tar.xz
 create mode 100644 git-2.14.1.tar.sign
 create mode 100644 git-2.14.1.tar.xz

diff --git a/git-2.14.0.tar.sign b/git-2.14.0.tar.sign
deleted file mode 100644
index 3a07df5fb9d3c0a3168d5af6aab661e6af76f858367273aef093e0b061abccfd..0000000000000000000000000000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 543
zcmV+)0^t3L0vrSY0SEvF1p--wr3?TH2@tTg=!TZB=F3W65C48WSUIcQ@9YRb94^M1
zN|&BAi2bS&@AA?A$Q>PH4ZY(#-!`M(CpnS70iDd>KU<!4E3*q{AfcHXC;-YHb531Q
zCp~7V(k%u=9PEW)<At8-%cx)3v29><#5Y#QT7<PXSHN&|&;4#3_*p8drJ!Dawp&^A
zyD*sQLB2BPpl#uI;fIyMvoE+3!a(Rkdeko<oA4-o1|5B&aYLm4Zi5`;qKZei--LYp
zke-Muq#>mp{BPp@%bHlntR~O$V8pAcmwwPd7YSN^&Ub6?wf@}?BY-`p2xTd_@Vfgg
z?e}#3nK$7v8dw1cKZMixW1gc8`%F-ZL(GqKaZhE$KF(-7f==_8j6An4ay1QjY*kor
zkk)Mqk<@`Y)n|2XI#~s`d(U+T1@|QWxwM}U;RS5W>3q^D^n4kc$T>SZL`F>mYh8hU
zJ7|_4X+z*K%0{ku*PVC^PX}~OcY|C3sI44hIv22H+<=j+csK8eCmo_WSl?Rnc2xS^
zhj$RcZ<SXRLs_lWcXKmrcEo?l6>kkY8H$sB$NtF1_GQaPfP6>8CTecf@xR9D8-C{_
zXpRP#HZ)A)UvIB4*`YlpjzJQFl#0*2O^#5s__$UuYVM)@q`G+DS0y8JCUMV^%#Mt5
hzz7ROMv7Jplk_0^=+*JEipvoK3S3n;9qZ0%bMhKr2X6oX

diff --git a/git-2.14.0.tar.xz b/git-2.14.0.tar.xz
deleted file mode 100644
index 7bf1777..0000000
--- a/git-2.14.0.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:f93e6e6a307d2e953cccafd9f4003c62992628fa508d07586476c953c1655975
-size 4790932
diff --git a/git-2.14.1.tar.sign b/git-2.14.1.tar.sign
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..49ca2eb514a96f18ba77c009db984e63f9ae21275e4979f7ddbd45b87ecdc5e2
GIT binary patch
literal 543
zcmV+)0^t3L0vrSY0SEvF1p--%YKQ;|2@tTg=!TZB=F9U35Bv|amn&7ywu~CdR_&ME
zaQeOHhtcMT6-aZEZ2gHx^@>A$lKt29gG1ovo1uftQuDu|zrmBsl$U3v*`sRV-@-06
zWvBCP>adcVL9(N=+~X27$*;BXx`alg45-X^*kU<vhM$%PqQj|{e@!E=$PaSq0CjOe
zd8jX9%gW2snQfe5=Wb;*4|42M`tMiju}v;Lpt0%bk(j>YBb=%*`}MF0fQ-UB5OLax
zxQMvj@<n4DG-_cE-=)G@mA-}+`0Zg)q2(ArkT6F<yve?n8OOUCSy5TcDGsD{M#v3D
zw+tEotYDLU{nvhc*O@84W!C;M^6AA~NxZ=Dz1{w0-(+;3CHdlUh1CWCEbr!0Y)!zY
zNlL#b_0fA$G~N5a@1n2kz+7IUwJ|6zHkbPpJrf^|GfrK!kvd2byS6j$oZBK5<q@XJ
z#bo5syRz}urrx;_33kPa&y<kdRseSdVK)(IB2h_bt*Dc6=ORgks5?6LEjTjQH}E*4
zYqY|fY2H3xhLS6R+l|f?*F1A<Zy2wJ^c5z?t)KJeThBQIaVeyABr8Be-6>kvPl{)N
zQ6X+j9MJ|;+)w~ALSTtq9!zihkR_xI^hf4<YM3pWUCh9%$bYezTNu-#6qWM$MtdR(
hRWDNa4BB2!HOR^0;Ay=Vr{j$1Z^SB};)FVSHS0ZS7xDlA

literal 0
HcmV?d00001

diff --git a/git-2.14.1.tar.xz b/git-2.14.1.tar.xz
new file mode 100644
index 0000000..eb894f1
--- /dev/null
+++ b/git-2.14.1.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6f724c6d0e9e13114ab35db6f67e1b2c1934b641e89366e6a0e37618231f2cc6
+size 4791876
diff --git a/git.changes b/git.changes
index 87b38e1..46c485d 100644
--- a/git.changes
+++ b/git.changes
@@ -1,3 +1,28 @@
+-------------------------------------------------------------------
+Thu Aug 10 19:19:07 UTC 2017 - astieger@suse.com
+
+- git 2.14.1 (bsc#1052481):
+  * Security fix for CVE-2017-1000117: A malicious third-party can
+    give a crafted "ssh://..." URL to an unsuspecting victim, and
+    an attempt to visit the URL can result in any program that
+    exists on the victim's machine being executed. Such a URL could
+    be placed in the .gitmodules file of a malicious project, and
+    an unsuspecting victim could be tricked into running
+    "git clone --recurse-submodules" to trigger the vulnerability.
+  * A "ssh://..." URL can result in a "ssh" command line with a
+    hostname that begins with a dash "-", which would cause the
+    "ssh" command to instead (mis)treat it as an option. This is
+    now prevented by forbidding such a hostname (which should not
+    impact any real-world usage).
+  * Similarly, when GIT_PROXY_COMMAND is configured, the command
+    is run with host and port that are parsed out from "ssh://..."
+    URL; a poorly written GIT_PROXY_COMMAND could be tricked into
+    treating a string that begins with a dash "-" as an option.
+    This is now prevented by forbidding such a hostname and port
+    number (again, which should not impact any real-world usage).
+  * In the same spirit, a repository name that begins with a dash
+    "-" is also forbidden now.
+
 -------------------------------------------------------------------
 Sat Aug  5 14:23:43 UTC 2017 - astieger@suse.com
 
diff --git a/git.spec b/git.spec
index 52113ae..9e0ea48 100644
--- a/git.spec
+++ b/git.spec
@@ -26,7 +26,7 @@
 %endif
 
 Name:           git
-Version:        2.14.0
+Version:        2.14.1
 Release:        0
 Summary:        Fast, scalable, distributed revision control system
 License:        GPL-2.0