Control: severity -1 minor On Thu, Aug 17, 2017 at 06:24:43PM +0530, Pirate Praveen wrote: > On Tue, 15 Aug 2017 07:40:59 +0200 Salvatore Bonaccorso > <car...@debian.org> wrote:> If you fix the vulnerability please also > make sure to include the > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > This is already fixed in git 1:2.11.0-3+deb9u1. The patch in gitlab is > extra step to prevent in case of a vulnerable git. Since debian already > has the fixed version of git, I don't think we need to do anything to > gitlab.
Agree, we can at least lower the severity and thanks a lot for the followup. The CVE seem to be specific assigned for the "via a crafted SSH URL in a project import". Can you close this bug once the gitlab version contains as well this extra safety measure if still running with older git? For the security tracker I have already downgraded the severity to unimportant. Regards, Salvatore
