Re: [exim] CVE-2019-10149: 4.87 to 4.91 are vulnerable

Top Page
Delete this message
Reply to this message
Author: Russell King
Date:  
To: hs
CC: exim-users, Heiko Schlittermann
Subject: Re: [exim] CVE-2019-10149: 4.87 to 4.91 are vulnerable
Hi,

While looking for the fix on the web version of git.exim.org, I find that
although I can get a listing based on the branch, I'm unable to get commit
or commitdiffs.

For example, the page at:

https://git.exim.org/exim.git/shortlog/refs/heads/exim-4_91+fixes

gives links such as:

<td class="link"><a href="/exim.git/shortlog/refs/heads/exim-4_91 fixes/exim.git/commit/d740d2111f189760593a303124ff6b9b1f83453d">commit</a> | <a href="/exim.git/shortlog/refs/heads/exim-4_91 fixes/exim.git/commitdiff/d740d2111f189760593a303124ff6b9b1f83453d">commitdiff</a>

Notice the space character where there should be a plus character.
This gives a gitweb page which contains "400 - Invalid hash parameter".

If I subsitute a + character there, or %2b, then the commitdiff page
still doesn't give me a commitdiff.

It looks like the gitweb you have doesn't like "+" in the branch names,
branches without a "+" character in them appear to work fine.

On Wed, Jun 05, 2019 at 02:21:18PM +0000, Heiko Schlittermann via Exim-users wrote:
> We will publish the fix today 2019-06-05 15:15 UTC on the exim-4_91+fixes branch of our public Git repo git.exim.org.
>
> Distros can release their packages by that date.
>
> Sorry for the inconveniences.
> --
> Heiko Schlittermann (unterwegs)




> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/



--
Russell King