libgit2 v1.8.5

v1.8.5

🔒 This is a security release with multiple changes.

A bug in the external SSH execution is fixed that could cause arbitrary command execution. Remote repository names were improperly sent to the shell without quoting. Arguments to the external SSH command are now sent parameterized.
A bug in SSH credential creation is fixed that could cause a buffer overflow. Public keys that are not NUL terminated were improperly zeroed. The given length of public keys is now honored.

The libgit2 project thanks @0xkato and @bakersdozen123 for finding the bugs and providing details and reproduction steps.

All users of the v1.8 release line are recommended to upgrade.

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.8.4...v1.8.5

🔒 This is a security release with multiple changes.

A bug in the external SSH execution is fixed that could cause arbitrary command execution. Remote repository names were improperly sent to the shell without quoting. Arguments to the external SSH command are now sent parameterized.
A bug in SSH credential creation is fixed that could cause a buffer overflow. Public keys that are not NUL terminated were improperly zeroed. The given length of public keys is now honored.

The libgit2 project thanks @0xkato and @bakersdozen123 for finding the bugs and providing details and reproduction steps.

All users of the v1.8 release line are recommended to upgrade.

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.8.4...v1.8.5