{"thread":{"id":"55278","subject":"[ANNOUNCE] Git v2.30.2 and below for CVE-2021-21300","startedAt":"2021-03-09T18:04:09Z","lastAt":"2021-03-09T18:04:09Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"418624","messageId":"xmqqim6019yd.fsf@gitster.c.googlers.com","threadId":"55278","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.30.2 and below for CVE-2021-21300","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-03-09T18:03:06Z","receivedAt":"2021-03-09T18:04:09Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release Git v2.30.2, together with releases\nfor older maintenance tracks v2.17.6, v2.18.5, v2.19.6, v2.20.5,\nv2.21.4, v2.22.5, v2.23.4, v2.24.4, v2.25.5, v2.26.3, v2.27.1,\nv2.28.1 and v2.29.3, is now available at the usual places.\n\nThese maintenance releases are to addresses the security issues\nCVE-2021-21300.  Please update.\n\nThe credit for these releases all goes to Matheus Tavares and\nJohannes Schindelin.  I didn't have to do anything but tagging their\nresult, cutting releases, and sending out this announcement.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.30.2'\ntag and the 'maint' branch that the tag points at:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\n----------------------------------------------------------------\n\nGit v2.30.2 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.17.6, v2.18.5,\nv2.19.6, v2.20.5, v2.21.4, v2.22.5, v2.23.4, v2.24.4, v2.25.5,\nv2.26.3, v2.27.1, v2.28.1 and v2.29.3 to address the security\nissue CVE-2021-21300; see the release notes for these versions\nfor details.\n\n----------------------------------------------------------------\n\nGit v2.17.6 Release Notes\n=========================\n\nThis release addresses the security issues CVE-2021-21300.\n\nFixes since v2.17.5\n-------------------\n\n * CVE-2021-21300:\n   On case-insensitive file systems with support for symbolic links,\n   if Git is configured globally to apply delay-capable clean/smudge\n   filters (such as Git LFS), Git could be fooled into running\n   remote code during a clone.\n\nCredit for finding and fixing this vulnerability goes to Matheus\nTavares, helped by Johannes Schindelin.\n"}]}