{"update": {"autokarma": true, "autotime": true, "stable_karma": 6, "stable_days": 14, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "Per the upstream release announcement\u00b9, this release fixes \"various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc.  See the release notes attached for the list for their descriptions and CVE identifiers.\"\n\nRefer to the 2.14.6 release notes\u00b2 for details on these vulnerabilities.\n\n\u00b9 https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/  \n\u00b2 https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt\n\n\n", "type": "security", "status": "stable", "request": null, "severity": "high", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": true, "critpath_groups": null, "close_bugs": true, "date_submitted": "2019-12-10 19:39:58", "date_modified": "2019-12-11 01:10:58", "date_approved": null, "date_testing": "2019-12-11 01:03:53", "date_stable": "2020-01-04 22:13:43", "alias": "FEDORA-2019-1cec196e20", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2020-01-04 22:13:43", "meets_testing_requirements": true, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2019-1cec196e20", "title": "git-2.21.1-1.fc30", "version_hash": "5249b2a51874f023be77fbc671b746c68feec8f3", "release": {"name": "F30", "long_name": "Fedora 30", "version": "30", "id_prefix": "FEDORA", "branch": "f30", "dist_tag": "f30", "stable_tag": "f30-updates", "testing_tag": "f30-updates-testing", "candidate_tag": "f30-updates-candidate", "pending_signing_tag": "f30-signing-pending", "pending_testing_tag": "f30-updates-testing-pending", "pending_stable_tag": "f30-updates-pending", "override_tag": "f30-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "setting_status": null}, "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by tmz. ", "timestamp": "2019-12-10 19:39:59", "update_id": 173708, "user_id": 91, "id": 1164448, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2019-12-10 19:39:59", "update_id": 173708, "user_id": 91, "id": 1164449, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2019-12-10 19:40:01", "update_id": 173708, "user_id": 91, "id": 1164450, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "tmz edited this update.", "timestamp": "2019-12-10 19:42:04", "update_id": 173708, "user_id": 91, "id": 1164454, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2019-12-11 01:04:32", "update_id": 173708, "user_id": 91, "id": 1164705, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "tmz edited this update.", "timestamp": "2019-12-11 01:10:58", "update_id": 173708, "user_id": 91, "id": 1164744, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "bug_feedback": [{"karma": 0, "comment_id": 1165076, "bug_id": 1781127, "bug": {"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781143, "bug": {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781953, "bug": {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781954, "bug": {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781955, "bug": {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781957, "bug": {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781958, "bug": {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781959, "bug": {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781960, "bug": {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781961, "bug": {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781963, "bug": {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781964, "bug": {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781966, "bug": {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781967, "bug": {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781968, "bug": {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781969, "bug": {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781971, "bug": {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781972, "bug": {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false}}], "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}, {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "bug_feedback": [{"karma": 0, "comment_id": 1165081, "bug_id": 1781127, "bug": {"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781143, "bug": {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781953, "bug": {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781954, "bug": {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781955, "bug": {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781957, "bug": {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781958, "bug": {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781959, "bug": {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781960, "bug": {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781961, "bug": {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781963, "bug": {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781964, "bug": {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781966, "bug": {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781967, "bug": {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781968, "bug": {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781969, "bug": {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781971, "bug": {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781972, "bug": {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false}}], "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}, {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "bug_feedback": [{"karma": 0, "comment_id": 1165090, "bug_id": 1781127, "bug": {"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781143, "bug": {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781953, "bug": {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781954, "bug": {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781955, "bug": {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781957, "bug": {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781958, "bug": {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781959, "bug": {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781960, "bug": {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781961, "bug": {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781963, "bug": {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781964, "bug": {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781966, "bug": {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781967, "bug": {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781968, "bug": {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781969, "bug": {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781971, "bug": {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781972, "bug": {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false}}], "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'greenwave_failed'.", "timestamp": "2019-12-24 05:21:39", "update_id": 173708, "user_id": 91, "id": 1177260, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2019-12-24 06:47:26", "update_id": 173708, "user_id": 91, "id": 1177400, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update can be pushed to stable now if the maintainer wishes", "timestamp": "2019-12-25 01:06:09", "update_id": 173708, "user_id": 91, "id": 1177880, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2019-12-25 01:06:11", "update_id": 173708, "user_id": 91, "id": 1177881, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "bug_feedback": [{"karma": 0, "comment_id": 1178699, "bug_id": 1781127, "bug": {"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781143, "bug": {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781953, "bug": {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781954, "bug": {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781955, "bug": {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781957, "bug": {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781958, "bug": {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781959, "bug": {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781960, "bug": {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781961, "bug": {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781963, "bug": {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781964, "bug": {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781966, "bug": {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781967, "bug": {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781968, "bug": {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781969, "bug": {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781971, "bug": {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781972, "bug": {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false}}], "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}, {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "bug_feedback": [{"karma": 0, "comment_id": 1178701, "bug_id": 1781127, "bug": {"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781143, "bug": {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781953, "bug": {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781954, "bug": {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781955, "bug": {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781957, "bug": {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781958, "bug": {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781959, "bug": {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781960, "bug": {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781961, "bug": {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781963, "bug": {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781964, "bug": {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781966, "bug": {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781967, "bug": {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781968, "bug": {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781969, "bug": {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781971, "bug": {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781972, "bug": {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false}}], "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}, {"karma": 0, "karma_critpath": 0, "text": "FEDORA-2019-1cec196e20 ejected from the push because \"Cannot find relevant tag for git-2.21.1-1.fc30.  None of ['f30-updates', 'f30-updates-pending'] are in ['dist-6E-epel-testing', 'epel7-testing', 'dist-5E-epel-testing', 'f27-modular-updates-testing', 'f30-modular-updates-testing', 'f30-container-updates-testing', 'f30-flatpak-updates-testing', 'f28-modular-updates-testing', 'f28-container-updates-testing', 'epel8-testing', 'f31-modular-updates-testing', 'f32-container-updates-testing', 'f31-container-updates-testing', 'f31-flatpak-updates-testing', 'f29-modular-updates-testing', 'f29-container-updates-testing', 'f29-flatpak-updates-testing', 'f22-updates-testing', 'f21-updates-testing', 'f25-updates-testing', 'f24-updates-testing', 'f23-updates-testing', 'f26-updates-testing', 'f27-updates-testing', 'f30-updates-testing', 'f28-updates-testing', 'f31-updates-testing', 'f32-updates-testing', 'f29-updates-testing', 'epel8-modular-updates-testing'].\"", "timestamp": "2020-01-03 09:44:28", "update_id": 173708, "user_id": 91, "id": 1183528, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2020-01-04 22:15:41", "update_id": 173708, "user_id": 91, "id": 1185162, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "git-2.21.1-1.fc30", "signed": true, "release_id": 28, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1781127, "title": "CVE-2019-1387 git: Remote code execution in recursive clones with nested submodules", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781127, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781127, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781127, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781127, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781143, "title": "CVE-2019-1349 git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781143, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781143, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781143, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781143, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781953, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks in-stream command feature", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781953, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781953, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781953, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781953, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781954, "title": "CVE-2019-1387 git: remote code execution in recursive clones with nested submodules [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781954, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781954, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781954, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781954, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781955, "title": "CVE-2019-1348 git: Arbitrary path overwriting via export-marks command option [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781955, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781955, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781955, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781955, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781957, "title": "CVE-2019-1349 git: recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781957, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781957, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781957, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781957, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781958, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781958, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781958, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781958, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781958, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781959, "title": "CVE-2019-1350 git: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781959, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781959, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781959, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781959, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781960, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781960, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781960, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781960, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781960, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781961, "title": "CVE-2019-1351 git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781961, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781961, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781961, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781961, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781963, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781963, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781963, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781963, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781963, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781964, "title": "CVE-2019-1352 git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781964, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781964, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781964, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781964, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781966, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781966, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781966, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781966, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781966, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781967, "title": "CVE-2019-1353 git: NTFS protections inactive when running Git in the Windows Subsystem for Linux [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781967, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781967, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781967, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781967, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781968, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781968, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781968, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781968, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781968, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781969, "title": "CVE-2019-1354 git: Git does not refuse to write out tracked files with backlashes in filenames [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781969, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781969, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781969, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781969, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781971, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781971, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781971, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781971, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781971, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}, {"bug_id": 1781972, "title": "CVE-2019-19604 git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 1171118, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "+1", "timestamp": "2019-12-17 10:40:25", "update_id": 173715, "user_id": 506, "id": 1171118, "testcase_feedback": [], "user": {"name": "smithp", "email": "smithpeter835@yahoo.co.uk", "id": 506, "avatar": "https://seccdn.libravatar.org/avatar/cdf0e9eb825568e6173694f0d1788bd389a980b3497928ce6f44f889943928a5?s=24&d=retro", "openid": "smithp.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}}, {"karma": 0, "comment_id": 1165735, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works", "timestamp": "2019-12-11 21:56:53", "update_id": 173715, "user_id": 491, "id": 1165735, "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1169878, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-16 07:45:13", "update_id": 173715, "user_id": 284, "id": 1169878, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 1168724, "bug_id": 1781972, "comment": {"karma": 0, "karma_critpath": 0, "text": "This is a pretty important security update - any reason not to push the button to ship it?", "timestamp": "2019-12-14 16:13:48", "update_id": 173715, "user_id": 738, "id": 1168724, "testcase_feedback": [], "user": {"name": "walters", "email": "walters@redhat.com", "id": 738, "avatar": "https://seccdn.libravatar.org/avatar/ee94e8f05af19f88894d776178dabb4ae93af5c0b7fe526be25447ad6c473ad2?s=24&d=retro", "openid": "walters.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "gitrpm-ostree"}, {"name": "modularity-wg"}, {"name": "gitlivecd"}, {"name": "signed_fpca"}, {"name": "cla_redhat"}, {"name": "gitspin-kickstarts"}, {"name": "ipausers"}, {"name": "atomic"}, {"name": "fedora-contributor"}, {"name": "gitfedora-atomic"}, {"name": "hgguest-account"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitroller-derby"}, {"name": "fedora-atomic-sig"}, {"name": "coreos"}, {"name": "cockpit-jenkins"}, {"name": "sig-cloud"}, {"name": "centosproject-email-aliases"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1168768, "bug_id": 1781972, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:47:10", "update_id": 173715, "user_id": 136, "id": 1168768, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1164938, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:45:58", "update_id": 173715, "user_id": 4325, "id": 1164938, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164939, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2019-12-11 08:47:12", "update_id": 173715, "user_id": 4325, "id": 1164939, "testcase_feedback": [], "user": {"name": "jlanda", "email": "julen@landa.eus", "id": 4325, "avatar": "https://seccdn.libravatar.org/avatar/65e8388bbee511ae25775390ecc852ee259bf2b1f8a75cbe8002920b175998f0?s=24&d=retro", "openid": "jlanda.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "fi-apprentice"}]}}}, {"karma": 0, "comment_id": 1164987, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "LGTM some basic tests.", "timestamp": "2019-12-11 10:15:07", "update_id": 173715, "user_id": 4120, "id": 1164987, "testcase_feedback": [], "user": {"name": "atim", "email": "ego.cordatus@gmail.com", "id": 4120, "avatar": "https://seccdn.libravatar.org/avatar/8c3a317a13d88ca7421098b94cce0501c97ca2283e7139c4992df34f6218fb3b?s=24&d=retro", "openid": "atim.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "rust-sig"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 1165076, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "Works great.", "timestamp": "2019-12-11 10:37:38", "update_id": 173708, "user_id": 5207, "id": 1165076, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165081, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:38:11", "update_id": 173708, "user_id": 5207, "id": 1165081, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165090, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "Seems to work great.", "timestamp": "2019-12-11 10:39:35", "update_id": 173708, "user_id": 5207, "id": 1165090, "testcase_feedback": [], "user": {"name": "mgrabovs", "email": "mgrabovs@redhat.com", "id": 5207, "avatar": "https://seccdn.libravatar.org/avatar/a3c4dbc41fddfa404f18a4d6662bc3f27b714adf88128192617040c3a243f5a6?s=24&d=retro", "openid": "mgrabovs.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "sysadmin"}, {"name": "abrt-sig"}, {"name": "gitabrt"}, {"name": "retrace"}, {"name": "sysadmin-retrace"}]}}}, {"karma": 0, "comment_id": 1165217, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:18:18", "update_id": 173715, "user_id": 1177, "id": 1165217, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165218, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:19:28", "update_id": 173715, "user_id": 1177, "id": 1165218, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165219, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM on x86_64.", "timestamp": "2019-12-11 13:20:11", "update_id": 173715, "user_id": 1177, "id": 1165219, "testcase_feedback": [], "user": {"name": "jayjayjazz", "email": "jayjayjazz@gmail.com", "id": 1177, "avatar": "https://seccdn.libravatar.org/avatar/b7f3994e0ba48616a78257e2477c106613cb1d0802ef48790f7b51d4d7943211?s=24&d=retro", "openid": "jayjayjazz.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 1165429, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:00:25", "update_id": 173715, "user_id": 4790, "id": 1165429, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1165430, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "WFM.", "timestamp": "2019-12-11 17:01:41", "update_id": 173715, "user_id": 4790, "id": 1165430, "testcase_feedback": [], "user": {"name": "elxreno", "email": "elxreno@gmail.com", "id": 4790, "avatar": "https://seccdn.libravatar.org/avatar/7bb8cf8c4245e545b14b472fd8070fc4541740e44fabdc703213da897f9ad87f?s=24&d=retro", "openid": "elxreno.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 1168769, "bug_id": 1781972, "comment": {"karma": 0, "karma_critpath": 0, "text": "Yes.  It's a bump from 2.23.0 to 2.24.1 (which was in the works before these issues arose).  While 5 of the 9 issues fixed here are rated as high severity (per https://github.com/git/git/security/advisories), only one of those 5 has the _potential_ to affect Linux users -- and even then only where git is cloning to an NTFS networked drive with short names enabled.\n\nSo the risk to Fedora users is considerably lower than it is to Windows git users.  (The severity is set to high per the security team's initial bug assessments, but I suspect that after more thorough review that might be lowered -- but the Fedora updates should all be pushed to stable before then.)\n\nThus I feel comfortable letting this spend a few more days in testing to ensure we don't run into any issues in the 2.23.0 -> 2.24.1 bump.  I really don't expect any thanks to the care which upstream takes to avoid regressions, but I'd rather not cause anyone trouble which can be avoided by a little more testing.\n\nThanks for the poke in any case.  I appreciate the nudge to ensure this wasn't an unintentional delay!", "timestamp": "2019-12-14 19:48:28", "update_id": 173715, "user_id": 136, "id": 1168769, "testcase_feedback": [], "user": {"name": "tmz", "email": "tmz@pobox.com", "id": 136, "avatar": "https://seccdn.libravatar.org/avatar/0ad6185a6acbd9fd4210c6d874b857b118e6373ea6e5fd3b56af40662c3a000b?s=24&d=retro", "openid": "tmz.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "web"}, {"name": "gitfedora-web"}, {"name": "git-maint"}, {"name": "gitkeychecker"}]}}}, {"karma": 0, "comment_id": 1178699, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:48:57", "update_id": 173708, "user_id": 311, "id": 1178699, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}, {"karma": 0, "comment_id": 1178701, "bug_id": 1781972, "comment": {"karma": 1, "karma_critpath": 0, "text": "works fine for me", "timestamp": "2019-12-26 15:50:07", "update_id": 173708, "user_id": 311, "id": 1178701, "testcase_feedback": [], "user": {"name": "flo", "email": "dev@der-flo.net", "id": 311, "avatar": "https://seccdn.libravatar.org/avatar/4b8991775229a7c27881d7038768f146db11d09d1cd0f07d78fd882a276936c8?s=24&d=retro", "openid": "flo.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}}]}], "updateid": "FEDORA-2019-1cec196e20", "karma": 2, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}