Accepted ikiwiki 3.20161229.1 (source) into unstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 29 Dec 2016 20:46:24 +0000
Source: ikiwiki
Binary: ikiwiki
Architecture: source
Version: 3.20161229.1
Distribution: unstable
Urgency: medium
Maintainer: Simon McVittie <smcv@debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
ikiwiki - wiki compiler
Changes:
ikiwiki (3.20161229.1) unstable; urgency=medium
.
* git: Attribute reverts to the user doing the revert, not the wiki
itself.
* git: Do not disable the commit hook while preparing a revert.
.
ikiwiki (3.20161229) unstable; urgency=medium
.
* Security: force CGI::FormBuilder->field to scalar context where
necessary, avoiding unintended function argument injection
analogous to CVE-2014-1572. In ikiwiki this could be used to
forge commit metadata, but thankfully nothing more serious.
(CVE-2016-9646)
* Security: try revert operations in a temporary working tree before
approving them. Previously, automatic rename detection could result in
a revert writing outside the wiki srcdir or altering a file that the
reverting user should not be able to alter, an authorization bypass.
(CVE-2016-10026 represents the original vulnerability.)
The incomplete fix released in 3.20161219 was not effective for git
versions prior to 2.8.0rc0.
(CVE-2016-9645 represents that incomplete solution.)
* Add CVE references for CVE-2016-10026
* Add automated test for using the CGI with git, including
CVE-2016-10026
- Build-depend on libipc-run-perl for better build-time test coverage
* Add missing ikiwiki.setup for the manual test for CVE-2016-10026
* git: don't issue a warning if the rcsinfo CGI parameter is undefined
* git: do not fail to commit changes with a recent git version
and an anonymous committer
Checksums-Sha1:
f33435f1ed0e9e944ba36c332e2c619f6ed9a815 2184 ikiwiki_3.20161229.1.dsc
fee9095d09a3b76721a955f87fe1266362744975 3477558 ikiwiki_3.20161229.1.tar.gz
Checksums-Sha256:
d25a49f20dda2179054a07098b1f051b78eaae3570c640edbf7200850df4d40b 2184 ikiwiki_3.20161229.1.dsc
8373a56a187d874d584b41d89c299d834f057017390520464b6d9615baf09650 3477558 ikiwiki_3.20161229.1.tar.gz
Files:
3c198e9c55d0f668a349c21d4a3c14d6 2184 web optional ikiwiki_3.20161229.1.dsc
2284c91d9c30752800410d63ccb826e7 3477558 web optional ikiwiki_3.20161229.1.tar.gz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAlhlgl0ACgkQTej/KmPH
zJAlew/9GvXYTS5c33KrjWf0ybEFAXef0LaXJT0XvxMBW3dJZeaQrYeWYMMSY7Lr
quA29t7W/pf9e3NxsGUSvVWL/lL/t4TTYIxaRbHqU9ihn9pCIb1cKP0Sc/WiDnPM
CUGe0Rxh0Bic61Yr0SjljsEGQMrfAEUVarv/iV+ZG0gsQh7T5rj7J7Q8mLh9Qcc5
F7uIMjxmDzcwt6S6RDSxJi80CtYVDBXYi985r+dH47mraI0cwv2daZ0hWnIfiHrN
Nq6FKjT+32Vv/43mgpoQHFftiUwZXmVsSchTyckLXhmtNid7SenqJLhfUs42OtLf
vYLhGfxjmY1IGeYcD+XZfl+yujh/ozH90lO4HHZShf83gAidoJdSZwbJ9eVyqd8k
VZbELq8ZtOqFFbvqSOSIotsJiqL6+Y+VzyYnAQc9RS10HUvpUVkc9juerPth9UdY
SltzWDuaXzUbYP11CvmKeLr6yiF8bdStm4ZtsZTna80eCbvUs/ZP/jE52OQDOcn1
V6fR+Pjxx2/p97iog3gp7uXex6zy03lkb0pRzyj9WL9mqS+/nqH3wt44x2BPwrek
OxjlSJjKQKhCRL4F9jnD99i5a1riAPmRcD5UKVQHwlYnHi27+bU3v6U/dDseainO
SSnbEg3TpVfi/GDlGCdnX5AZSXaa2t3mNCEmJHC98h8n7iSZKmQ=
=o+N4
-----END PGP SIGNATURE-----