1. 04 Mar, 2022 1 commit
  2. 03 Mar, 2022 2 commits
  3. 02 Mar, 2022 1 commit
  4. 28 Feb, 2022 1 commit
  5. 25 Feb, 2022 2 commits
  6. 24 Feb, 2022 6 commits
  7. 22 Feb, 2022 4 commits
  8. 21 Feb, 2022 3 commits
  9. 18 Feb, 2022 1 commit
  10. 13 Feb, 2022 1 commit
    • Marc Cornellà's avatar
      fix: apply workaround patch for vcs_info (CVE-2021-45444) · ef3f7c43
      Marc Cornellà authored
      This lib function applies a patch to the VCS_INFO_formats function
      in zsh versions from v5.0.3 until v5.8, which don't quote % chars
      in some arguments received. Normally that just means that some
      % characters in these strings (branch names, directories, etc.)
      will be incorrectly parsed as formatting sequences.
      
      With CVE-2021-45444, however, this means that one of these strings
      from a malicious source (e.g. a malicious git repository) can
      trigger command injection and run arbitrary code in the user's
      machine when visiting such git repository.
      
      Zsh 5.8.1 fixes this vulnerability [1], but older vcs_info setups
      still need a workaround such as this one to patch the vulnerability.
      
      [1] https://github.com/zsh-users/zsh/commit/c3ea1e5d52eff8b7b172fa8c1ccc3462b43b2790
      ef3f7c43
  11. 11 Feb, 2022 4 commits
  12. 10 Feb, 2022 8 commits
  13. 09 Feb, 2022 2 commits
  14. 07 Feb, 2022 4 commits