retitle 561727 git-core: git help -a (/etc/bash_completion.d/git) accesses files outside the user's home dir (possible DoS) severity 561727 grave thanks
I confirm that git tries to access and read files above the current directory (e.g. outside the user's home directory), and there's a possible denial of service, e.g. if something like: mkdir .git touch .git/objects .git/refs mkfifo .git/HEAD is done (actually, this isn't even needed, as here the process sometimes freezes when NFS tries to automount .git or something like that, but with the above command, the freeze seems to be permanent). -- Vincent Lefèvre <[email protected]> - Web: <http://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <http://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Arénaire project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
