Hi, Am Montag, den 18.07.2016, 11:44 +0200 schrieb Joachim Breitner: > A fix is probably to put quotes around $(git log ...).
Possibly not, the script seems to rely on the shell’s splitting of words here, which would be prevented by quotes. > This might be security relevant. I could not make it execute arbitrary code so far, but a denial of service using /*/*/*/*/*/ in the commit message works. Greetings, Joachim -- Joachim “nomeata” Breitner Debian Developer [email protected] • https://people.debian.org/~nomeata XMPP: [email protected] • GPG-Key: 0xF0FBF51F https://www.joachim-breitner.de/
signature.asc
Description: This is a digitally signed message part
