Update to latest git (CVE mitigation)

cloudfoundry-community / jumpbox-boshrelease

A BOSH release for jumpboxen

MIT License

22 stars 27 forks source link

Update to latest git (CVE mitigation) #62

Closed amuessig closed 5 years ago

amuessig commented 6 years ago

Hi,

just wondering what's the process for updating packages? There are some major CVE reports on git version 2.14.1 that is used and should be updated in this repo.. (CVE-2018-11233, CVE-2018-11235)

And/or how can I check if it is already uploaded to the s3 bucket? So I could do a pull request for this..

@jhunt @starkandwayne-bot Thanks

jhunt commented 6 years ago

Some blobs we track. Others we don't. git falls into the latter. Opening an issue like this asking for an update is probably the easiest way, for now.

amuessig commented 6 years ago

Thanks. Is there any chance that you upload an updated version of git to your blobstore so I could build the release on my own for the meantime?

jhunt commented 6 years ago

You shouldn't need it in the blobstore; you can test locally. Then you can take your changes to the packaging script (if any) and submit them as a PR.