From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dalaran.tastycake.net (dalaran.tastycake.net [IPv6:2001:ba8:0:1c0::1:1]) by sourceware.org (Postfix) with ESMTPS id 05E713858D39 for ; Wed, 19 Oct 2022 11:58:41 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 05E713858D39 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=dinwoodie.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=dinwoodie.org Received: from c.a.1.d.d.f.6.c.f.8.d.f.b.e.b.6.d.a.0.2.5.1.e.d.0.b.8.0.1.0.0.2.ip6.arpa ([2001:8b0:de15:20ad:6beb:fd8f:c6fd:d1ac] helo=lucy.dinwoodie.org) by dalaran.tastycake.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ol7iZ-0005hm-7j for cygwin-announce@cygwin.com; Wed, 19 Oct 2022 12:58:39 +0100 Received: from adam by lucy.dinwoodie.org with local (Exim 4.94.2) (envelope-from ) id 1ol7iY-00AqMJ-6g for cygwin-announce@cygwin.com; Wed, 19 Oct 2022 12:58:38 +0100 Date: Wed, 19 Oct 2022 12:58:38 +0100 From: Adam Dinwoodie To: cygwin-announce@cygwin.com Subject: Security update: Git v2.38.1 Message-ID: <20221019115838.iuztckl46ehzwv3b@lucy.dinwoodie.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-1.6 required=5.0 tests=BAYES_00,KAM_DMARC_STATUS,KAM_NUMSUBJECT,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Version 2.38.1-1 of Git has been uploaded to the Cygwin distribution servers, and should be coming soon to a mirror near you. Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. This is an update to the latest upstream release, and includes the following packages: - git - git-cvs - git-debuginfo - git-email - git-gui - gitk - git-p4 - git-svn Selected extracts from the changelog: > This release addresses the security issues CVE-2022-39253 and > CVE-2022-39260. > > * CVE-2022-39253: > When relying on the `--local` clone optimization, Git dereferences > symbolic links in the source repository before creating hardlinks > (or copies) of the dereferenced link in the destination repository. > This can lead to surprising behavior where arbitrary files are > present in a repository's `$GIT_DIR` when cloning from a malicious > repository. > > Git will no longer dereference symbolic links via the `--local` > clone mechanism, and will instead refuse to clone repositories that > have symbolic links present in the `$GIT_DIR/objects` directory. > > Additionally, the value of `protocol.file.allow` is changed to be > "user" by default. > > * CVE-2022-39260: > An overly-long command string given to `git shell` can result in > overflow in `split_cmdline()`, leading to arbitrary heap writes and > remote code execution when `git shell` is exposed and the directory > `$HOME/git-shell-commands` exists. > > `git shell` is taught to refuse interactive commands that are > longer than 4MiB in size. `split_cmdline()` is hardened to reject > inputs larger than 2GiB. For a full list of the upstream changes in this release, please refer to the upstream changelogs: https://git.kernel.org/cgit/git/git.git/tree/Documentation/RelNotes https://kernel.googlesource.com/pub/scm/git/git.git/+/master/Documentation/RelNotes/ https://github.com/git/git/tree/master/Documentation/RelNotes Enjoy! Adam