{"push_id":653625087,"size":2,"distinct_size":1,"ref":"refs/heads/rhel7","head":"59ff790d03707aabd896caf20c645b614c85fe1c","before":"61f1e91d26797edf5182d9226d82137d9b9652e3","commits":[{"sha":"a4e47c753e9d7988f4d938ed2e0fd690a909ce68","author":{"email":"a21a19d0d0e5e95d18fd01c97d46a0237bf4a197@redhat.com","name":"Jakub Filak"},"message":"upload: validate and sanitize uploaded dump directories\n\nIt was discovered that, when moving problem reports from\n/var/spool/abrt-upload to /var/spool/abrt or /var/tmp/abrt,\nabrt-handle-upload does not verify that the new problem directory\nhas appropriate permissions and does not contain symbolic links.  A\ncrafted problem report exposes other parts of abrt to attack, and\nthe abrt-handle-upload script allows to overwrite arbitrary files.\n\nAcknowledgement:\n\nThis issue was discovered by Florian Weimer of Red Hat Product Security.\n\nRelated: #1212953\n\nSigned-off-by: Jakub Filak <jfilak@redhat.com>","distinct":false,"url":"https://api.github.com/repos/abrt/abrt/commits/a4e47c753e9d7988f4d938ed2e0fd690a909ce68"},{"sha":"59ff790d03707aabd896caf20c645b614c85fe1c","author":{"email":"e59fa6e982b842f21df46cd65219dde2a2a080a0@redhat.com","name":"Marek Bryša"},"message":"Merge pull request #954 from abrt/rhel7_abrt_upload_watch_sanitize\n\nRHEL7: upload: validate and sanitize uploaded dump directories","distinct":true,"url":"https://api.github.com/repos/abrt/abrt/commits/59ff790d03707aabd896caf20c645b614c85fe1c"}]}