Merge pull request libgit2#75 from libgit2/cmn/sec-update

carlosmn · web-flow · commit acd0d90a1756 · 2017-01-09T20:37:35.000Z
Write up the cert check callback advisory
diff --git a/security/index.md b/security/index.md
@@ -7,6 +7,19 @@ layout: default
 Information about security advisories affecting libgit2 and the releases that
 provide resolution.
 
+* **[libgit2 v0.24.6](https://github.com/libgit2/libgit2/releases/tag/v0.24.6)** and **[libgit2 v0.25.1](https://github.com/libgit2/libgit2/releases/tag/v0.25.1)**, January 9th, 2017  
+Includes two fixes, one performs extra sanitization for some edge cases in
+the Git Smart Protocol which can lead to attempting to parse outside of the
+buffer.<br><br>
+The second fix affects the certificate check callback. It provides a `valid`
+parameter to indicate whether the native cryptographic library considered the
+certificate to be correct. This parameter is always `1`/`true` before these
+releases leading to a possible MITM.<br><br>
+This does not affect you if you do not use the custom certificate callback
+or if you do not take this value into account. This does affect you if
+you use pygit2 or git2go regardless of whether you specify a certificate
+check callback.
+
 * **[libgit2 v0.22.1](https://github.com/libgit2/libgit2/releases/tag/v0.22.1)**, January 16, 2015  
 Provides additional protections on symbolic links on case-insensitive
 filesystems, particularly Mac OS X HFS+.
