{"thread":{"id":"46558","subject":"[ANNOUNCE] Git v2.14.1, v2.13.5, and others","startedAt":"2017-08-10T18:00:25Z","lastAt":"2017-08-10T18:00:25Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"326042","messageId":"xmqqh8xf482j.fsf@gitster.mtv.corp.google.com","threadId":"46558","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.14.1, v2.13.5, and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-08-10T18:00:04Z","receivedAt":"2017-08-10T18:00:25Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release Git v2.14.1 is now available at the\nusual places, together with releases for older maintenance track for\nthe same issue: v2.7.6, v2.8.6, v2.9.5, v2.10.4, v2.11.3, v2.12.4,\nand v2.13.5.\n\nThese contain a security fix for CVE-2017-1000117, and are released\nin coordination with Subversion and Mercurial that share a similar\nissue.  CVE-2017-9800 and CVE-2017-1000116 are assigned to these\nsystems, respectively, for issues similar to it that are now\naddressed in their part of this coordinated release.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of these tags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\nA malicious third-party can give a crafted \"ssh://...\" URL to an\nunsuspecting victim, and an attempt to visit the URL can result in\nany program that exists on the victim's machine being executed.\nSuch a URL could be placed in the .gitmodules file of a malicious\nproject, and an unsuspecting victim could be tricked into running\n\"git clone --recurse-submodules\" to trigger the vulnerability.\n\nCredits to find and fix the issue go to Brian Neel at GitLab, Joern\nSchneeweisz of Recurity Labs and Jeff King at GitHub.\n\n * A \"ssh://...\" URL can result in a \"ssh\" command line with a\n   hostname that begins with a dash \"-\", which would cause the \"ssh\"\n   command to instead (mis)treat it as an option.  This is now\n   prevented by forbidding such a hostname (which should not impact\n   any real-world usage).\n\n * Similarly, when GIT_PROXY_COMMAND is configured, the command is\n   run with host and port that are parsed out from \"ssh://...\" URL;\n   a poorly written GIT_PROXY_COMMAND could be tricked into treating\n   a string that begins with a dash \"-\" as an option.  This is now\n   prevented by forbidding such a hostname and port number (again,\n   which should not impact any real-world usage).\n\n * In the same spirit, a repository name that begins with a dash \"-\"\n   is also forbidden now.\n"}]}