What I concerned has finally happend. nectar committed a patch to cvs without (in my view) maintainers’ permission.

Security officer will often cause some panic when they are overriding maintainer’s privilege. With this in mind, the commit in question is somewhat “strange” that nectar doesn’t plan to MFC it to RELENG_5_2, as he replied my question: “Quick question: are these commit candidate for MFC to RELENG_5_2?” a “No”.

Original commitlog:

Incorporate two security fixes from later versions of CVS.
From the NEWS file of cvs 1.11.11:

* pserver can no longer be configured to run as root via the
$CVSROOT/CVSROOT/passwd file, so if your passwd file is
compromised, it no longer leads directly to a root hack. Attempts
to root will also be logged via the syslog.

* Malformed module requests could cause the CVS server to attempt
to create directories and possibly files at the root of the
filesystem holding the CVS repository. Filesystem permissions
usually prevent the creation of these misplaced directories, but
nevertheless, the CVS server now rejects the malformed requests.

Obtained from: ccvs.cvshome.org