git: git-daemon Denial of Service

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-util/git	< 1.6.3.3	>= 1.6.3.3	All supported architectures

Related bugreports: #273905

An error in git-daemon might lead to a Denial of Service via resource consumption.

2. Impact Information

git - the stupid content tracker, the revision control system used by the Linux kernel team.

Shawn O. Pearce reported that git-daemon runs into an infinite loop when handling requests that contain unrecognized arguments.

A remote unauthenticated attacker could send a specially crafted request to git-daemon, possibly leading to a Denial of Service (CPU consumption).

3. Resolution Information

There is no known workaround at this time.

All git users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/git-1.6.3.3"

4. References

Page updated July 12, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.