{"thread":{"id":"55553","subject":"Security vulnerability in Git for Cygwin","startedAt":"2021-04-24T20:33:13Z","lastAt":"2021-04-24T21:04:53Z","messageCount":2,"participants":["Adam Dinwoodie"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"422862","messageId":"CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw@mail.gmail.com","threadId":"55553","inReplyTo":null,"subject":"Security vulnerability in Git for Cygwin","fromName":"Adam Dinwoodie","fromEmail":"adam@dinwoodie.org","sentAt":"2021-04-24T20:32:35Z","receivedAt":"2021-04-24T20:33:13Z","isPatch":false,"sender":{"key":"adam@dinwoodie.org","avatar":"https://avatars.githubusercontent.com/u/1397507?v=4"},"body":"Hi folks,\n\nI don't typically announce Cygwin releases of Git on this mailing\nlist, but this one's for a security vulnerability, and in particular\nI'd like to catch the (hopefully very small number of) people who use\nGit on Cygwin compiling it themselves.\n\nI've just uploaded version 2.31.1-2 of Git to the Cygwin distribution\nserver, and it will be being distributed to the Cygwin mirrors over\nthe next few hours.\n\nThis update addresses CVE-2021-29468, which would cause Git to\noverwrite arbitrary files with attacker-controlled contents when\nchecking out content from a malicious repository, and in particular\nwould allow an attacker to overwrite Git hooks to execute arbitrary\ncode.\n\nHaving discussed with the Git security list, I believe there are very\nfew people compiling Git on Cygwin themselves, and therefore agreed to\nrelease the patched Cygwin build without yet having a patch in the\nmain Git source code. However if you do use a version of Git on Cygwin\nthat isn't from the official Cygwin distribution servers, I'd strongly\nrecommend either not checking out or cloning from any untrusted\nrepositories until you've applied at least the functional part of the\npatch I'll be submitting shortly.\n\nI'd like to thank RyotaK (https://github.com/Ry0taK /\nhttps://twitter.com/ryotkak) for finding and responsibly disclosing\nthis vulnerability, and Johannes Schindelin for helping manage the\nresponse.\n\nKind regards,\n\nAdam\n"},{"id":"422863","messageId":"CA+kUOamj=PfpHsYB4J9=C48zX75aJ9wAf_LgJqFSee+WyJh68A@mail.gmail.com","threadId":"55553","inReplyTo":"CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw@mail.gmail.com","subject":"Re: Security vulnerability in Git for Cygwin","fromName":"Adam Dinwoodie","fromEmail":"adam@dinwoodie.org","sentAt":"2021-04-24T21:04:04Z","receivedAt":"2021-04-24T21:04:53Z","isPatch":false,"sender":{"key":"adam@dinwoodie.org","avatar":"https://avatars.githubusercontent.com/u/1397507?v=4"},"body":"On Sat, 24 Apr 2021 at 21:32, Adam Dinwoodie <adam@dinwoodie.org> wrote:\n> I don't typically announce Cygwin releases of Git on this mailing\n> list, but this one's for a security vulnerability, and in particular\n> I'd like to catch the (hopefully very small number of) people who use\n> Git on Cygwin compiling it themselves.\n>\n> I've just uploaded version 2.31.1-2 of Git to the Cygwin distribution\n> server, and it will be being distributed to the Cygwin mirrors over\n> the next few hours.\n>\n> This update addresses CVE-2021-29468, which would cause Git to\n> overwrite arbitrary files with attacker-controlled contents when\n> checking out content from a malicious repository, and in particular\n> would allow an attacker to overwrite Git hooks to execute arbitrary\n> code.\n>\n> Having discussed with the Git security list, I believe there are very\n> few people compiling Git on Cygwin themselves, and therefore agreed to\n> release the patched Cygwin build without yet having a patch in the\n> main Git source code. However if you do use a version of Git on Cygwin\n> that isn't from the official Cygwin distribution servers, I'd strongly\n> recommend either not checking out or cloning from any untrusted\n> repositories until you've applied at least the functional part of the\n> patch I'll be submitting shortly.\n>\n> I'd like to thank RyotaK (https://github.com/Ry0taK /\n> https://twitter.com/ryotkak) for finding and responsibly disclosing\n> this vulnerability, and Johannes Schindelin for helping manage the\n> response.\n\nOne note I failed to put in the original email: there is further\ninformation on this vulnerability in the GitHub Security Advisory at\nhttps://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557\n"}]}