[OE-core] [PATCH] git: CVE-2017-14867

[Alexander Kanavin]

On 10/23/2017 08:39 PM, Ovidiu Panait wrote:
> Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before
> 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support
> subcommands such as cvsserver, which allows attackers to execute arbitrary
> OS commands via shell metacharacters in a module name. The vulnerable code
> is reachable via git-shell even without CVS support.

It's better to simply update the recipe to the latest version that does 
not have the vulnerability, can you do that please?


Alex