Re: [oss-security] Dulwich security issue (fwd)

2015-03-24 Thread Elena ``of Valhalla''
On 2015-03-24 at 10:18:32 +0100, Andrew Shadura wrote: Actually, we've just got another person interested in creating a Debian package: welcome Elena, who's volunteered to help with it. hello Basically, I'm interested in running kallithea, and my home server runs on the policy that if it's

Re: [oss-security] Dulwich security issue (fwd)

2015-03-24 Thread Andrew Shadura
Hello, On 23 March 2015 at 16:00, Adi Kriegisch a...@cg.tuwien.ac.at wrote: I downloaded the source locally, applied the patch and installed within the venv. Actually I hope Kallithea will soon be Debian packaged to make fixing of issues like that easier... :) Actually, we've just got another

Re: [oss-security] Dulwich security issue (fwd)

2015-03-23 Thread Mads Kiilerich
On 03/23/2015 09:14 AM, Adi Kriegisch wrote: Hey! ...anything we need to do about that? I don't know. I guess all we can do is to inform all users that they probably have it installed as a dependency and that they should upgrade. We could perhaps make a secure version mandatory in next

Re: [oss-security] Dulwich security issue (fwd)

2015-03-23 Thread Andrew Shadura
Hi, On 23 March 2015 at 15:41, Mads Kiilerich m...@kiilerich.com wrote: I don't know. I guess all we can do is to inform all users that they probably have it installed as a dependency and that they should upgrade. We could perhaps make a secure version mandatory in next release. I can

[oss-security] Dulwich security issue (fwd)

2015-03-23 Thread Adi Kriegisch
Hey! ...anything we need to do about that? -- Adi ---BeginMessage--- Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function in Dulwich. This function is used when accessing Git objects in pack files. Any Git server or client

Re: [oss-security] Dulwich security issue (fwd)

2015-03-23 Thread Mads Kiilerich
On 03/23/2015 04:00 PM, Adi Kriegisch wrote: 0.9.9 seems to be a fix for 0.9.8 that does a version update too but it does not seem to be pip installable from any known sources. It is now available with pip install --upgrade dulwich==0.9.9 - after patching Kallithea setup.py and expanding the