Add advisory for git2: Remote::list() with an empty list triggers UB

[DanielEScherzer]

Affected crate(s)

• git2

Links to upstream issue(s) or PR(s)

rust-lang/git2-rs#1217, rust-lang/git2-rs#1250

Severity

Low? Potential UB from misuse of an unsafe function

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[DanielEScherzer]

Date is set as the date of the PR to fix the issue being created

Filed pre-emptively with versions > 0.20.4, will update once a new version has been released

[djc]

• Asked maintainer(s) if publishing an advisory is appropriate

Not seeing a public comment from the maintainer about approval of publishing a RustSec advisory.

[DanielEScherzer]

@weihanglo thoughts?

[weihanglo]

The description is accurate.