Possible bug reports for git-credential-libsecret
From: 우승훈[ 대학원석·박사통합과정수료연구(재학) / 컴퓨터학과 ] <seunghoonwoo@korea.ac.kr>
Date: 2022-03-18 17:13:46
Dear Git Development team Hi. Recently, I noted that the vulnerability patch (CVE-2020-5260) for "git credential" is not applied in the "git-credential-libsecret" program (./contrib/credential/libsecret/git-credential-libsecret.c). Actually, I'm not sure whether "git-credential-libsecret" is actually used. But it can be potentially intimidating, thus it would be good to apply the same patch of "git credential" to "git-credential-libsecret". - Patch for CVE-2020-5260 * https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b - Similar but not patched code in "git-credential-libsecret" * https://github.com/git/git/blob/master/contrib/credential/libsecret/git-credential-libsecret.c#L306-L311 * When I put the malicious URL in the test code shown in the CVE-2020-5260 patch into "git-credential-libsecret", it does not terminate. Could you please check whether this is an actual bug? Thank you. Best regards, Seunghoon Woo -- Best regards, Seunghoon Woo Korea University Dept. of Computer Science and Engineering Computer & Communication Security Lab. seunghoonwoo@korea.ac.kr (+82)10-8147-9308