Update Rust crate git2 to 0.21 [SECURITY] #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/crate-git2-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
0.20→0.21git2 has potential undefined behavior when dereferencing Buf struct
GHSA-j39j-6gw9-jw6h / RUSTSEC-2026-0008
More information
Details
If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Potential undefined behavior when dereferencing Buf struct
GHSA-j39j-6gw9-jw6h / RUSTSEC-2026-0008
More information
Details
if we dereference the Buf struct right after calling new() or default() on Buf struct, it passes Null Pointer to the unsafe function slice::from_raw_parts. Based on the safety section documentation of function,
data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing Null Pointer will lead to undefined behavior.
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Potential undefined behavior when calling Remote::list()
RUSTSEC-2026-0183
More information
Details
When calling
Remote::list()for a remote of a git repository, when that remote does not advertise any references, git2 passes a null pointer to the unsafe functionslice::from_raw_parts(). Based on the safety section documentation of function, data must be non-null even for slices of length zero. Thus, the use of a null pointer leads to undefined behavior.Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Potential undefined behavior with Signature from a buffer-created BlameHunk
RUSTSEC-2026-0184
More information
Details
When a
Blameis created viaBlame::blame_buffer(), and aBlameHunkis retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The correspondingBlameHunkmethods then createSignatures based on null pointers; attempting to access the data of theSignatures leads to dereferencing null pointers.Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.