{"thread":{"id":"53227","subject":"[Announce] Git v2.26.1 and others","startedAt":"2020-04-14T18:03:32Z","lastAt":"2020-04-14T18:03:32Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"395428","messageId":"xmqqy2qy7xn8.fsf@gitster.c.googlers.com","threadId":"53227","inReplyTo":null,"subject":"[Announce] Git v2.26.1 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-04-14T18:03:23Z","receivedAt":"2020-04-14T18:03:32Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Today, the Git project is releasing the following Git versions:\n\n    v2.26.1, v2.25.3, v2.24.2, v2.23.2, v2.22.3, v2.21.2, v2.20.3,\n    v2.19.4, v2.18.3, and v2.17.4\n\nThese releases address the security issue CVE-2020-5260, which\nallowed a crafted URL to trick a Git client to send credential\ninformation for a wrong host to the attacker's site.  Credit for\nfinding the vulnerability goes to Felix Wilhelm of Google Project\nZero, and credit for fixing it goes to Jeff King of GitHub.\n\nUsers of the affected maintenance tracks are urged to upgrade.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.26.1'\nand other tags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\nAttached below is the release notes for 2.17.4; all the newer\nmaintenance tracks listed at the beginning of this message are\nupdated with the same fix, so I won't repeat them here.\n\nThanks.\n\n--------------------------------------------------\nGit v2.17.4 Release Notes\n=========================\n\nThis release is to address the security issue: CVE-2020-5260\n\nFixes since v2.17.3\n-------------------\n\n * With a crafted URL that contains a newline in it, the credential\n   helper machinery can be fooled to give credential information for\n   a wrong host.  The attack has been made impossible by forbidding\n   a newline character in any value passed via the credential\n   protocol.\n\nCredit for finding the vulnerability goes to Felix Wilhelm of Google\nProject Zero.\n"}]}