Git Users Should Get To Updating Due To An Arbitrary Code Execution Vulnerability

[phoronix]

Phoronix: Git Users Should Get To Updating Due To An Arbitrary Code Execution Vulnerability

Git maintainer Junio Hamano issued new versions of this widely-used version control system today going back to the Git 2.14 release series in order to address a new security vulnerability...

http://www.phoronix.com/scan.php?page=news_item&px=Git-gitmodules-Vulnerability

[uid313]

Ubuntu 18.10 comes with old Git 2.17, not 2.19.

Edit: Looks like 2.19 is available in the cosmic-proposed repository.

[Tuxee]

Ubuntu 18.10 comes with old Git 2.17, not 2.19.

What's the issue? Adding the git-core ppa to any Ubuntu distro is a must.

[uid313]

What's the issue? Adding the git-core ppa to any Ubuntu distro is a must.

It seems 2.19 is available in the cosmic-proposed repository.

[pal666]

nobody suggested rust rewrite yet?

[GreenByte]

nobody suggested rust rewrite yet?

As if a different language would have prevented the issue.

[kaprikawn]

Ubuntu 18.10 comes with old Git 2.17, not 2.19.

Edit: Looks like 2.19 is available in the cosmic-proposed repository.

The article says the fix is being backported to all versions back to 2.14, so how is this a problem?

[uid313]

nobody suggested rust rewrite yet?

Well, Rust is more suited for some kinds of things. For other things it strengths don't come much in play, and any language will do.
Rust is well suited for things like parsers and decoders.
But for application software any language will do, Rust could be used, but probably doesn't bring much of value over any other language.

The article says the fix is being backported to all versions back to 2.14, so how is this a problem?

Because even if the old versions get patched with fixes for the security vulnerability, I would rather use the new version as it has more features and functionality.

[kaprikawn]

Well, Rust is more suited for some kinds of things. For other things it strengths don't come much in play, and any language will do.
Rust is well suited for things like parsers and decoders.
But for application software any language will do, Rust could be used, but probably doesn't bring much of value over any other language.


Because even if the old versions get patched with fixes for the security vulnerability, I would rather use the new version as it has more features and functionality.

1) He was referencing the 'rewrite in Rust' meme, I don't think it was a serious suggestion.
2) It wasn't clear you were making a general point about the git version in Ubuntu, you were posting in a thread about a security vulnerability in git after all. If you're so bothered about using the latest and greatest, why not run a rolling release distro like Arch, Manjaro or Suse Tumbleweed? Surely using a fixed-release distro and enabling a bunch of unsupported and potentially incompatible PPAs runs the risk of instability? I can understand enabling the Mesa PPA or something like that. But if you're wanting the latest version of something like Git it sounds like a rolling release distro would be more suitable for your needs.

[aht0]

uid313 so what new functionalities are present in newer versions BUT not available in 2.14 - that you need? Or it's just 'I want newer because it' "newer"'?