X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:references
	:mime-version:content-type:in-reply-to; q=dns; s=default; b=xkhx
	uqhA2QwxglrvsgFkrMFtl07BsEGy1ic68YCgewbdKN+RX6yXZVWQszUojck2QPIQ
	++cSVs/Ga04Jg1aIdpNZMtJAwQm8mcHQOx4TmGnRv8RRKq2NdNzFHm+vYo1hdLtA
	FFfXMRzp6f3ZPkhIb7fVqgqSySnOmGnhLhJG0Uc=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:references
	:mime-version:content-type:in-reply-to; s=default; bh=mcVx1Be86+
	ASlKdE4+c5jrZN8ZE=; b=UOnVIWHTEnMcJpbEMpoJyyDhOqXY0FYRfn/Ga26OT9
	gMAga/fs1KWjc+ml32P5nd7I5ioF9q8qRNHMR8yD0CUK3d6rSoXlVL3hr1OMFfmi
	lfVM8LhX0rMe82nfwSUZbuYGQ2wf1U7hjeIOsQh07IYaqr0TPonuEnORertjQ0LG
	o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
X-HELO: mail-wi0-f174.google.com
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;        d=1e100.net; s=20130820;        h=x-gm-message-state:date:from:to:subject:message-id:references         :mime-version:content-type:content-disposition:in-reply-to         :user-agent;        bh=18sxMJHQI4chxhTHjp+xMuteg0fHd8kYyw015OCp/+M=;        b=D4xOgMKpzeBteW97Cmqr1U5Nt9ecSlKa+/qjvwLM3ATQl/HjX70OiqWhdhNGltUqnp         4c8GVHZrLQnsGGPTUqAmzMzxC5uVGO5c24tp8YMER96XoyVCuc8Bn6xKT+zkHQGPCiCx         2To07YkREuN1b7Cg7woj+wM7msWqWUK+Gwokw6eEOkseC/Pd3XJUNNwSgpTV046KM8qb         d0E9SaYiZYHIklFN3O3MBT6TN8diTPV2eSZGB8C/S/eLzLtV6T/E5qbM5lGXAxCzAcWH         eOa6tCO2F6WEmfJaOUIgZIbgQbm8GrZxFmCiM7IXxDhhfxjqffiS201Ji1Fr/sd1KRwS         7b1Q==
X-Gm-Message-State: ALoCoQnYCxs92gmjU0q/g4F1cSNKkQVmBn+ylHYAfCq/hFAwfrDT4HNAxJGbsjYf6wRJqv79yqqx
X-Received: by 10.194.200.1 with SMTP id jo1mr41869390wjc.64.1419249998202;        Mon, 22 Dec 2014 04:06:38 -0800 (PST)
Date: Mon, 22 Dec 2014 12:06:29 +0000
From: Adam Dinwoodie <adam AT dinwoodie DOT org>
To: cygwin AT cygwin DOT com
Subject: Re: Major Git vulnerability announced; when can we expect an update to the Cygwin git package?
Message-ID: <20141222120629.GA20436@dinwoodie.org>
References: <CAKL2AYOa3LNYC7xgg_8xUqiej10X47HUB4QQK5xUnJZR7mn_Eg AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAKL2AYOa3LNYC7xgg_8xUqiej10X47HUB4QQK5xUnJZR7mn_Eg@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-IsSubscribed: yes

On Thu, Dec 18, 2014 at 03:50:52PM -0800, Richard Mehlinger wrote:
> Git has announced a major vulnerability, allowing attackers to set up
> a malicious git repository that can be used to take over a client
> computer: https://github.com/blog/1938-vulnerability-announced-update-your-git-clients.
> Maintenance releases are already out for current Git versions.
> 
> My question is: When can we expect an update to the Cygwin git package
> to address these concerns?

I'm aware of the vulnerability and intend to publish a new package as
soon as possible.  A combination of the holiday period, technical
problems and assorted other real life is making this more difficult than
I would like, but I expect to get it released by 11 January at the
absolute latest, and hopefully much sooner than that.

Adam

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple