{"thread":{"id":"52422","subject":"[ANNOUNCE] Git v2.24.1 and others","startedAt":"2019-12-10T18:05:52Z","lastAt":"2019-12-10T18:05:52Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"387901","messageId":"xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com","threadId":"52422","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.24.1 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2019-12-10T18:05:46Z","receivedAt":"2019-12-10T18:05:52Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Today, the Git project is releasing the following Git versions:\n\n    v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2,\n    v2.17.3, v2.16.6, v2.15.4, and v2.14.6\n\nThese releases fix various security flaws, which allowed an attacker\nto overwrite arbitrary paths, remotely execute code, and/or overwrite\nfiles in the .git/ directory etc.  See the release notes attached for\nthe list for their descriptions and CVE identifiers.\n\nUsers of the affected maintenance tracks are urged to upgrade.\n\nThese flaws were discovered and reported by Joern Schneeweisz of\nGitLab and by Microsoft Security Response Center (and in particular\nNicolas Joly), and were fixed by Johannes Schindelin, Jeff King,\nGarima Singh and Jonathan Nieder on the git-security mailing list.\nThe release engineering and coordination was led by Johannes\nSchindelin.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.24.1'\nand other tags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\n----------------------------------------------------------------\n\nGit v2.14.6 Release Notes\n=========================\n\nThis release addresses the security issues CVE-2019-1348,\nCVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,\nCVE-2019-1353, CVE-2019-1354, and CVE-2019-1387.\n\nFixes since v2.14.5\n-------------------\n\n * CVE-2019-1348:\n   The --export-marks option of git fast-import is exposed also via\n   the in-stream command feature export-marks=... and it allows\n   overwriting arbitrary paths.\n\n * CVE-2019-1349:\n   When submodules are cloned recursively, under certain circumstances\n   Git could be fooled into using the same Git directory twice. We now\n   require the directory to be empty.\n\n * CVE-2019-1350:\n   Incorrect quoting of command-line arguments allowed remote code\n   execution during a recursive clone in conjunction with SSH URLs.\n\n * CVE-2019-1351:\n   While the only permitted drive letters for physical drives on\n   Windows are letters of the US-English alphabet, this restriction\n   does not apply to virtual drives assigned via subst <letter>:\n   <path>. Git mistook such paths for relative paths, allowing writing\n   outside of the worktree while cloning.\n\n * CVE-2019-1352:\n   Git was unaware of NTFS Alternate Data Streams, allowing files\n   inside the .git/ directory to be overwritten during a clone.\n\n * CVE-2019-1353:\n   When running Git in the Windows Subsystem for Linux (also known as\n   \"WSL\") while accessing a working directory on a regular Windows\n   drive, none of the NTFS protections were active.\n\n * CVE-2019-1354:\n   Filenames on Linux/Unix can contain backslashes. On Windows,\n   backslashes are directory separators. Git did not use to refuse to\n   write out tracked files with such filenames.\n\n * CVE-2019-1387:\n   Recursive clones are currently affected by a vulnerability that is\n   caused by too-lax validation of submodule names, allowing very\n   targeted attacks via remote code execution in recursive clones.\n\nCredit for finding these vulnerabilities goes to Microsoft Security\nResponse Center, in particular to Nicolas Joly. The `fast-import`\nfixes were provided by Jeff King, the other fixes by Johannes\nSchindelin with help from Garima Singh.\n\n\nGit v2.15.4 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6 to address\nthe security issues CVE-2019-1348, CVE-2019-1349, CVE-2019-1350,\nCVE-2019-1351, CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, and\nCVE-2019-1387; see the release notes for that version for details.\n\nIn conjunction with a vulnerability that was fixed in v2.20.2,\n`.gitmodules` is no longer allowed to contain entries of the form\n`submodule.<name>.update=!command`.\n\n\nGit v2.16.6 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6 and in\nv2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,\nCVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,\nCVE-2019-1354, and CVE-2019-1387; see the release notes for those\nversions for details.\n\n\nGit v2.17.3 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6 and in\nv2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,\nCVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,\nCVE-2019-1354, and CVE-2019-1387; see the release notes for those\nversions for details.\n\nIn addition, `git fsck` was taught to identify `.gitmodules` entries\nof the form `submodule.<name>.update=!command`, which have been\ndisallowed in v2.15.4.\n\n\nGit v2.18.2 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4\nand in v2.17.3, addressing the security issues CVE-2019-1348,\nCVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,\nCVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes\nfor those versions for details.\n\n\nGit v2.19.3 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4\nand in v2.17.3, addressing the security issues CVE-2019-1348,\nCVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,\nCVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes\nfor those versions for details.\n\n\nGit v2.20.2 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4\nand in v2.17.3, addressing the security issues CVE-2019-1348,\nCVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,\nCVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes\nfor those versions for details.\n\nThe change to disallow `submodule.<name>.update=!command` entries in\n`.gitmodules` which was introduced v2.15.4 (and for which v2.17.3\nadded explicit fsck checks) fixes the vulnerability in v2.20.x where a\nrecursive clone followed by a submodule update could execute code\ncontained within the repository without the user explicitly having\nasked for that (CVE-2019-19604).\n\nCredit for finding this vulnerability goes to Joern Schneeweisz,\ncredit for the fixes goes to Jonathan Nieder.\n\n\nGit v2.21.1 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4,\nv2.17.3 and in v2.20.2, addressing the security issues CVE-2019-1348,\nCVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,\nCVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and CVE-2019-19604;\nsee the release notes for those versions for details.\n\nAdditionally, this version also includes a couple of fixes for the\nWindows-specific quoting of command-line arguments when Git executes\na Unix shell on Windows.\n\n\nGit v2.22.2 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4,\nv2.17.3, v2.20.2 and in v2.21.1, addressing the security issues\nCVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,\nCVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and\nCVE-2019-19604; see the release notes for those versions for details.\n\n\nGit v2.23.1 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4,\nv2.17.3, v2.20.2 and in v2.21.1, addressing the security issues\nCVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,\nCVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and\nCVE-2019-19604; see the release notes for those versions for details.\n\n\nGit v2.24.1 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.14.6, v2.15.4,\nv2.17.3, v2.20.2 and in v2.21.1, addressing the security issues\nCVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,\nCVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and\nCVE-2019-19604; see the release notes for those versions for details.\n\n\n"}]}