@@ -6,7 +6,7 @@

cmake_minimum_required(VERSION 3.5.1)

project(libgit2 VERSION “1.5.0” LANGUAGES C)

project(libgit2 VERSION “1.5.1” LANGUAGES C)

Add find modules to the path

set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} “${PROJECT_SOURCE_DIR}/cmake”)

@@ -144,6 +144,11 @@ if [ -z “$SKIP_SSH_TESTS” ]; then

echo "[localhost]:2222 $algorithm $key" >>"${HOME}/.ssh/known_hosts"

done <"${SSHD_DIR}/id_rsa.pub"

Append the github.com keys for the tests that don’t override checks.

We ask for ssh-rsa to test that the selection based off of known_hosts

is working.

ssh-keyscan -t ssh-rsa github.com >>"${HOME}/.ssh/known_hosts"

Get the fingerprint for localhost and remove the colons so we can

parse it as a hex number. Older versions have a different output

format.

@@ -1,3 +1,14 @@

v1.5.1

------

🔒 This is a security release to address CVE-2023-22742: when compiled using the optional, included libssh2 backend, libgit2 fails to verify SSH keys by default.

When using an SSH remote with the optional, included libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2’s `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack.

The libgit2 security team would like to thank the Julia and Rust security teams for responsibly disclosing this vulnerability and assisting with fixing the vulnerability.

All users of the v1.5 release line are recommended to upgrade.

v1.5

----

@@ -11,7 +11,7 @@

* The version string for libgit2. This string follows semantic

* versioning (v2) guidelines.

*/

#define LIBGIT2_VERSION “1.5.0”

#define LIBGIT2_VERSION “1.5.1”

/** The major version number for this version of libgit2. */

#define LIBGIT2_VER_MAJOR 1

@@ -20,7 +20,7 @@

#define LIBGIT2_VER_MINOR 5

/** The revision (“teeny”) version number for this version of libgit2. */

#define LIBGIT2_VER_REVISION 0

#define LIBGIT2_VER_REVISION 1

/** The Windows DLL patch number for this version of libgit2. */

#define LIBGIT2_VER_PATCH 0

@@ -1,6 +1,6 @@

{

"name": "libgit2",

"version": "1.5.0",

"version": "1.5.1",

"repo": "https://github.com/libgit2/libgit2",

"description": " A cross-platform, linkable library implementation of Git that you can use in your application.",

"install": “mkdir build && cd build && cmake … && cmake --build .”

0 comments on commit 42e5db9

Please sign in to comment.