{"thread":{"id":"46835","subject":"[ANNOUNCE] Git v2.13.6 and others","startedAt":"2017-09-26T06:09:19Z","lastAt":"2017-09-26T06:09:19Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"328931","messageId":"xmqqy3p29ekj.fsf@gitster.mtv.corp.google.com","threadId":"46835","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.13.6 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-09-26T06:09:00Z","receivedAt":"2017-09-26T06:09:19Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Maintenance releases Git v2.10.5, v2.11.4, v2.12.5 and v2.13.6 are\nnow available at the usual places.  These are solely about hardening\n\"git shell\" that is used on servers against an unsafe user input,\nwhich \"git cvsserver\" copes with poorly.  A copy of the release notes\nfor v2.10.5 is attached at the end of the message, but the notes for\nother releases listed above essentially say the same thing.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.10.5',\n'v2.11.4', 'v2.12.5' and 'v2.13.6' tags and some of them have the\n'maint-2.10', 'maint-2.11', 'maint-2.12' and 'maint-2.13' branches\nthat the tags point at:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\nNote that the committed version of the release notes for these\nversions all incorrectly mention \"git daemon\", where they should\nhave said \"git shell\".  It has been corrected in the attached copy,\nbut because the release engineering was done several days in advance\nand the tags have already been shared with binary packagers and\nothers at the git-security@googlegroups.com mailing list, these\nrelease tarballs are issued _with_ the known typo to avoid confusion\nof having two release tags with different contents.  Sorry about that.\n\n----------------------------------------------------------------\n\nGit v2.10.5 Release Notes\n=========================\n\nFixes since v2.10.4\n-------------------\n\n * \"git cvsserver\" no longer is invoked by \"git shell\" by default,\n   as it is old and largely unmaintained.\n\n * Various Perl scripts did not use safe_pipe_capture() instead of\n   backticks, leaving them susceptible to end-user input.  They have\n   been corrected.\n\nCredits go to joernchen <joernchen@phenoelit.de> for finding the\nunsafe constructs in \"git cvsserver\", and to Jeff King at GitHub for\nfinding and fixing instances of the same issue in other scripts.\n\n----------------------------------------------------------------\n\nChanges since v2.10.4 are as follows:\n\nJeff King (3):\n      shell: drop git-cvsserver support by default\n      archimport: use safe_pipe_capture for user input\n      cvsimport: shell-quote variable used in backticks\n\nJunio C Hamano (3):\n      cvsserver: move safe_pipe_capture() to the main package\n      cvsserver: use safe_pipe_capture for `constant commands` as well\n      Git 2.10.5\n\njoernchen (1):\n      cvsserver: use safe_pipe_capture instead of backticks\n\n"}]}