{"push_id":1260289181,"size":8,"distinct_size":8,"ref":"refs/heads/master","head":"d232448a6b2b34110c807692a46498bf41b2dfcf","before":"03667246ca7ddf10ad464ba2409c1ebf7489b311","commits":[{"sha":"83d8dbca3edc65de072d64b6380fbd49b2f83e2b","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"fail2ban won't start until the roundcube log file is created\n\nfixes #911","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/83d8dbca3edc65de072d64b6380fbd49b2f83e2b"},{"sha":"7c9f3e0b23506e322220ff586449aa58c420385f","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"v0.19a","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/7c9f3e0b23506e322220ff586449aa58c420385f"},{"sha":"86457e5bc43610a34389e6963a1280653f088aae","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"merge: fail2ban broke, released v0.19a","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/86457e5bc43610a34389e6963a1280653f088aae"},{"sha":"35a360ef0b0d8de3d20327ef0e4b6459492efd07","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"simplify how munin-cgi-graph is called to reduce the attack surface area\n\nSeems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.\n\nSince this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/35a360ef0b0d8de3d20327ef0e4b6459492efd07"},{"sha":"a14b17794bd9a02e07f9aff2f6213a6e7d26fc2d","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"simplify how munin-cgi-graph is called to reduce the attack surface area\n\nSeems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.\n\nSince this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.\n\nThe vulnerability was created by 6d6f3ea3919d81abfd1a6eddd8787c98b761e1bb.\n\nSee #914.\n\nThis is the v0.19b hotfix commit.","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/a14b17794bd9a02e07f9aff2f6213a6e7d26fc2d"},{"sha":"ba75ff7820c652d6ba935ff0619d055cccec3ae6","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"v0.19b","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/ba75ff7820c652d6ba935ff0619d055cccec3ae6"},{"sha":"27b4edfc761e8bdfcefda499e1f7dd84ed7a42f8","author":{"name":"Joshua Tauberer","email":"715f1f3217132bac17182bed7e3d2e712f2f4fd3@occams.info"},"message":"merge v0.19b hot fix release","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/27b4edfc761e8bdfcefda499e1f7dd84ed7a42f8"},{"sha":"d232448a6b2b34110c807692a46498bf41b2dfcf","author":{"name":"jvolkenant","email":"f438ab86509b0904a4f8dc4741adff5f32e23439@volkenant.net"},"message":"Fix sync to upstream v0.19b","distinct":true,"url":"https://api.github.com/repos/jvolkenant/mailinabox/commits/d232448a6b2b34110c807692a46498bf41b2dfcf"}]}
{"actor":{"display_login":"jvolkenant"}}