From c4debc99097b6da64cf64ca5009b595ebc95e135 Mon Sep 17 00:00:00 2001 From: Nicolas Cavallari Date: Wed, 10 Dec 2025 14:14:21 +0100 Subject: [PATCH] package/libgit2: security bump version to 1.9.2 Fix two vulnerabilities related to SSH support: * The external SSH execution code lacked shell quoting on repositories name, resulting in arbitrary command execution. * SSH public keys were zeroed by calling memset with the wrong length, resulting in either buffer overflow or incomplete zeroing. Release notes: https://github.com/libgit2/libgit2/releases/tag/v1.9.2 Signed-off-by: Nicolas Cavallari Signed-off-by: Julien Olivain --- package/libgit2/libgit2.hash | 2 +- package/libgit2/libgit2.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libgit2/libgit2.hash b/package/libgit2/libgit2.hash index 8c9b210581..e8c155c994 100644 --- a/package/libgit2/libgit2.hash +++ b/package/libgit2/libgit2.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 14cab3014b2b7ad75970ff4548e83615f74d719afe00aa479b4a889c1e13fc00 libgit2-1.9.1.tar.gz +sha256 6f097c82fc06ece4f40539fb17e9d41baf1a5a2fc26b1b8562d21b89bc355fe6 libgit2-1.9.2.tar.gz sha256 e3712465634e97cfd850822a4eb5ac7d2f8a10f753189366d5a2060046f28288 COPYING diff --git a/package/libgit2/libgit2.mk b/package/libgit2/libgit2.mk index f615484edb..34cb67929e 100644 --- a/package/libgit2/libgit2.mk +++ b/package/libgit2/libgit2.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBGIT2_VERSION = 1.9.1 +LIBGIT2_VERSION = 1.9.2 LIBGIT2_SITE = $(call github,libgit2,libgit2,v$(LIBGIT2_VERSION)) LIBGIT2_LICENSE = \ GPL-2.0 with linking exception, \