X-Recipient: archive-cygwin AT delorie DOT com X-Original-To: cygwin AT cygwin DOT com Delivered-To: cygwin AT cygwin DOT com DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 05E713858D39 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=dinwoodie.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=dinwoodie.org Date: Wed, 19 Oct 2022 12:58:38 +0100 From: Adam Dinwoodie To: cygwin AT cygwin DOT com Subject: [ANNOUNCEMENT] Security update: Git v2.38.1 Message-Id: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-1.6 required=5.0 tests=BAYES_00, KAM_DMARC_STATUS, KAM_NUMSUBJECT, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: cygwin-announce AT cygwin DOT com X-Mailman-Version: 2.1.29 X-Mailer: Perl5 Mail::Internet v2.20 X-BeenThere: cygwin AT cygwin DOT com List-Id: General Cygwin discussions and problem reports List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: cygwin AT cygwin DOT com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "Cygwin" Version 2.38.1-1 of Git has been uploaded to the Cygwin distribution servers, and should be coming soon to a mirror near you. Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. This is an update to the latest upstream release, and includes the following packages: - git - git-cvs - git-debuginfo - git-email - git-gui - gitk - git-p4 - git-svn Selected extracts from the changelog: > This release addresses the security issues CVE-2022-39253 and > CVE-2022-39260. > > * CVE-2022-39253: > When relying on the `--local` clone optimization, Git dereferences > symbolic links in the source repository before creating hardlinks > (or copies) of the dereferenced link in the destination repository. > This can lead to surprising behavior where arbitrary files are > present in a repository's `$GIT_DIR` when cloning from a malicious > repository. > > Git will no longer dereference symbolic links via the `--local` > clone mechanism, and will instead refuse to clone repositories that > have symbolic links present in the `$GIT_DIR/objects` directory. > > Additionally, the value of `protocol.file.allow` is changed to be > "user" by default. > > * CVE-2022-39260: > An overly-long command string given to `git shell` can result in > overflow in `split_cmdline()`, leading to arbitrary heap writes and > remote code execution when `git shell` is exposed and the directory > `$HOME/git-shell-commands` exists. > > `git shell` is taught to refuse interactive commands that are > longer than 4MiB in size. `split_cmdline()` is hardened to reject > inputs larger than 2GiB. For a full list of the upstream changes in this release, please refer to the upstream changelogs: https://git.kernel.org/cgit/git/git.git/tree/Documentation/RelNotes https://kernel.googlesource.com/pub/scm/git/git.git/+/master/Documentation/RelNotes/ https://github.com/git/git/tree/master/Documentation/RelNotes Enjoy! Adam -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple