public inbox for
 help / color / mirror / Atom feed
* [ANNOUNCEMENT] Security update: Git v2.38.1
@ 2022-10-19 11:58 Adam Dinwoodie
  0 siblings, 0 replies; only message in thread
From: Adam Dinwoodie @ 2022-10-19 11:58 UTC (permalink / raw)
  To: cygwin

Version 2.38.1-1 of Git has been uploaded to the Cygwin distribution
servers, and should be coming soon to a mirror near you.

Git is a free and open source distributed version control system
designed to handle everything from small to very large projects with
speed and efficiency.

This is an update to the latest upstream release, and includes the
following packages:

- git
- git-cvs
- git-debuginfo
- git-email
- git-gui
- gitk
- git-p4
- git-svn

Selected extracts from the changelog:

> This release addresses the security issues CVE-2022-39253 and
> CVE-2022-39260.
>  * CVE-2022-39253:
>    When relying on the `--local` clone optimization, Git dereferences
>    symbolic links in the source repository before creating hardlinks
>    (or copies) of the dereferenced link in the destination repository.
>    This can lead to surprising behavior where arbitrary files are
>    present in a repository's `$GIT_DIR` when cloning from a malicious
>    repository.
>    Git will no longer dereference symbolic links via the `--local`
>    clone mechanism, and will instead refuse to clone repositories that
>    have symbolic links present in the `$GIT_DIR/objects` directory.
>    Additionally, the value of `protocol.file.allow` is changed to be
>    "user" by default.
>  * CVE-2022-39260:
>    An overly-long command string given to `git shell` can result in
>    overflow in `split_cmdline()`, leading to arbitrary heap writes and
>    remote code execution when `git shell` is exposed and the directory
>    `$HOME/git-shell-commands` exists.
>    `git shell` is taught to refuse interactive commands that are
>    longer than 4MiB in size. `split_cmdline()` is hardened to reject
>    inputs larger than 2GiB.

For a full list of the upstream changes in this release, please refer to
the upstream changelogs:



^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2022-10-19 11:59 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-19 11:58 [ANNOUNCEMENT] Security update: Git v2.38.1 Adam Dinwoodie

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).