{"thread":{"id":"45916","subject":"[ANNOUNCE] Git v2.12.3 and others","startedAt":"2017-05-10T00:07:11Z","lastAt":"2017-05-10T00:38:48Z","messageCount":2,"participants":["Junio C Hamano","Jonathan Nieder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"319243","messageId":"xmqq8tm5ziat.fsf@gitster.mtv.corp.google.com","threadId":"45916","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.12.3 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-05-10T00:06:50Z","receivedAt":"2017-05-10T00:07:11Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Maintenance releases Git v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5,\nv2.9.4, v2.10.3, v2.11.2, and v2.12.3 have been tagged and are now\navailable at the usual places.\n\nThese are primarily to fix a recently disclosed problem with \"git\nshell\", which may allow a user who comes over SSH to run an\ninteractive pager by causing it to spawn \"git upload-pack --help\"\n(CVE-2017-8386).  Some (like v2.12.3) have other fixes that have\nbeen accumulating included as well.\n\n\"git-shell\" is a restricted login shell that can be used on a server\nto prevent SSH clients from running any programs except those needed\nfor git fetches and pushes. If you are not running a server, or if\nyour server has not been explicitly configured to use git-shell as a\nlogin shell, you are not affected.  Also note that sites running \"git\nshell\" behind gitolite are NOT vulnerable.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of these tags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = git://git.sourceforge.jp/gitroot/git-core/git.git\n  url = git://git-core.git.sourceforge.net/gitroot/git-core/git-core\n  url = https://github.com/gitster/git\n"},{"id":"319244","messageId":"20170510003823.GT28740@aiede.svl.corp.google.com","threadId":"45916","inReplyTo":"xmqq8tm5ziat.fsf@gitster.mtv.corp.google.com","subject":"Re: [ANNOUNCE] Git v2.12.3 and others","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2017-05-10T00:38:23Z","receivedAt":"2017-05-10T00:38:48Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Junio C Hamano wrote:\n\n> Maintenance releases Git v2.4.12, v2.5.6, v2.6.7, v2.7.5, v2.8.5,\n> v2.9.4, v2.10.3, v2.11.2, and v2.12.3 have been tagged and are now\n> available at the usual places.\n>\n> These are primarily to fix a recently disclosed problem with \"git\n> shell\", which may allow a user who comes over SSH to run an\n> interactive pager by causing it to spawn \"git upload-pack --help\"\n> (CVE-2017-8386).  Some (like v2.12.3) have other fixes that have\n> been accumulating included as well.\n>\n> \"git-shell\" is a restricted login shell that can be used on a server\n> to prevent SSH clients from running any programs except those needed\n> for git fetches and pushes. If you are not running a server, or if\n> your server has not been explicitly configured to use git-shell as a\n> login shell, you are not affected.  Also note that sites running \"git\n> shell\" behind gitolite are NOT vulnerable.\n\nThanks.  Credit for discovering this bug goes to Timo Schmid, ERNW GmbH.\nThey will probably have a blog post soon with more details.\n\n1.6.1 is the earliest git version affected (so this goes back pretty\nfar).\n\n> The tarballs are found at:\n>\n>     https://www.kernel.org/pub/software/scm/git/\n>\n> The following public repositories all have a copy of these tags:\n>\n>   url = https://kernel.googlesource.com/pub/scm/git/git\n>   url = git://repo.or.cz/alt-git.git\n>   url = git://git.sourceforge.jp/gitroot/git-core/git.git\n>   url = git://git-core.git.sourceforge.net/gitroot/git-core/git-core\n>   url = https://github.com/gitster/git\n\nSincerely,\nJonathan\n"}]}