[SECURITY] Fedora 28 Update: git-annex-6.20180626-1.fc28
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-e22c8eb218
2018-07-11 20:15:57.507790
--------------------------------------------------------------------------------
Name : git-annex
Product : Fedora 28
Version : 6.20180626
Release : 1.fc28
URL : https://hackage.haskell.org/package/git-annex
Summary : Manage files with git, without checking their contents into git
Description :
Git-annex allows managing files with git, without checking the file contents
into git. While that may seem paradoxical, it is useful when dealing with files
larger than git can currently easily handle, whether due to limitations in
memory, time, or disk space.
It can store large files in many places, from local hard drives, to a large
number of cloud storage services, including S3, WebDAV, and rsync, with a dozen
cloud storage providers usable via plugins. Files can be stored encrypted with
gpg, so that the cloud storage provider cannot see your data.
git-annex keeps track of where each file is stored, so it knows how many copies
are available, and has many facilities to ensure your data is preserved.
git-annex can also be used to keep a folder in sync between computers, noticing
when files are changed, and automatically committing them to git and
transferring them to other computers. The git-annex webapp makes it easy to set
up and use git-annex this way.
--------------------------------------------------------------------------------
Update Information:
Update to 6.20180626 Security fix for CVE-2018-10857 and CVE-2018-10859
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jun 28 2018 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> -
6.20180626-1
- update to 6.20180626
- Fix CVE-2018-10857 and CVE-2018-10859 (#1595634)
* Fri Apr 20 2018 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> -
6.20180409-1
- update to 6.20180409
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1595631 - CVE-2018-10857 git-annex: Private data exposure and exfiltration
https://bugzilla.redhat.com/show_bug.cgi?id=1595631
[ 2 ] Bug #1595633 - CVE-2018-10859 git-annex: Malicious server could trick git-annex
into decrypting a file encrypted to the user's gpg key
https://bugzilla.redhat.com/show_bug.cgi?id=1595633
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-e22c8eb218' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------