-
Notifications
You must be signed in to change notification settings - Fork 25.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
18 changed files
with
350 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
Git v2.30.8 Release Notes | ||
========================= | ||
|
||
This release addresses the security issues CVE-2023-22490 and | ||
CVE-2023-23946. | ||
|
||
|
||
Fixes since v2.30.7 | ||
------------------- | ||
|
||
* CVE-2023-22490: | ||
|
||
Using a specially-crafted repository, Git can be tricked into using | ||
its local clone optimization even when using a non-local transport. | ||
Though Git will abort local clones whose source $GIT_DIR/objects | ||
directory contains symbolic links (c.f., CVE-2022-39253), the objects | ||
directory itself may still be a symbolic link. | ||
|
||
These two may be combined to include arbitrary files based on known | ||
paths on the victim's filesystem within the malicious repository's | ||
working copy, allowing for data exfiltration in a similar manner as | ||
CVE-2022-39253. | ||
|
||
* CVE-2023-23946: | ||
|
||
By feeding a crafted input to "git apply", a path outside the | ||
working tree can be overwritten as the user who is running "git | ||
apply". | ||
|
||
* A mismatched type in `attr.c::read_attr_from_index()` which could | ||
cause Git to errantly reject attributes on Windows and 32-bit Linux | ||
has been corrected. | ||
|
||
Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was | ||
developed by Taylor Blau, with additional help from others on the | ||
Git security mailing list. | ||
|
||
Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the | ||
fix was developed by Patrick Steinhardt. | ||
|
||
|
||
Johannes Schindelin (1): | ||
attr: adjust a mismatched data type | ||
|
||
Patrick Steinhardt (1): | ||
apply: fix writing behind newly created symbolic links | ||
|
||
Taylor Blau (3): | ||
t5619: demonstrate clone_local() with ambiguous transport | ||
clone: delay picking a transport until after get_repo_path() | ||
dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
Git v2.31.7 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8 to | ||
address the security issues CVE-2023-22490 and CVE-2023-23946; | ||
see the release notes for that version for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
Git v2.32.6 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8 and v2.31.7 | ||
to address the security issues CVE-2023-22490 and CVE-2023-23946; | ||
see the release notes for these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.33.7 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7 | ||
and v2.32.6 to address the security issues CVE-2023-22490 and | ||
CVE-2023-23946; see the release notes for these versions for | ||
details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.34.7 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6 and v2.33.7 to address the security issues CVE-2023-22490 | ||
and CVE-2023-23946; see the release notes for these versions | ||
for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.35.7 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6, v2.33.7 and v2.34.7 to address the security issues | ||
CVE-2023-22490 and CVE-2023-23946; see the release notes for | ||
these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.36.5 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6, v2.33.7, v2.34.7 and v2.35.7 to address the security | ||
issues CVE-2023-22490 and CVE-2023-23946; see the release notes | ||
for these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.37.6 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6, v2.33.7, v2.34.7, v2.35.7 and v2.36.5 to address the | ||
security issues CVE-2023-22490 and CVE-2023-23946; see the release | ||
notes for these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.38.4 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6, v2.33.7, v2.34.7, v2.35.7, v2.36.5 and v2.37.6 to | ||
address the security issues CVE-2023-22490 and CVE-2023-23946; | ||
see the release notes for these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
Git v2.39.2 Release Notes | ||
========================= | ||
|
||
This release merges up the fixes that appear in v2.30.8, v2.31.7, | ||
v2.32.6, v2.33.7, v2.34.7, v2.35.7, v2.36.5, v2.37.6 and v2.38.4 | ||
to address the security issues CVE-2023-22490 and CVE-2023-23946; | ||
see the release notes for these versions for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.