{"thread":{"id":"57715","subject":"[ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765","startedAt":"2022-04-12T17:01:32Z","lastAt":"2022-04-14T00:22:15Z","messageCount":3,"participants":["Junio C Hamano","SZEDER Gábor"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"453450","messageId":"xmqqv8veb5i6.fsf@gitster.g","threadId":"57715","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-12T17:01:21Z","receivedAt":"2022-04-12T17:01:32Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release Git v2.35.2, together with releases\nfor older maintenance tracks v2.30.3, v2.31.2, v2.32.1, v2.33.2, and\nv2.34.2, are now available at the usual places.\n\nThese maintenance releases are to address the security issues\ndescribed in CVE-2022-24765.  Please update at your earliest\nopportunity.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.35.2',\n'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3' tags.\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = https://github.com/gitster/git\n\nCVE-2022-24765:\n   On multi-user machines, Git users might find themselves\n   unexpectedly in a Git worktree, e.g. when another user created a\n   repository in `C:\\.git`, in a mounted network drive or in a\n   scratch space. Merely having a Git-aware prompt that runs `git\n   status` (or `git diff`) and navigating to a directory which is\n   supposedly not a Git worktree, or opening such a directory in an\n   editor or IDE such as VS Code or Atom, will potentially run\n   commands defined by that other user.\n\nCredit for finding this vulnerability goes to 俞晨东; the fix was\nauthored by Johannes Schindelin.\n"},{"id":"453455","messageId":"20220412180510.GA2173@szeder.dev","threadId":"57715","inReplyTo":"xmqqv8veb5i6.fsf@gitster.g","subject":"Re: [ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765","fromName":"SZEDER Gábor","fromEmail":"szeder.dev@gmail.com","sentAt":"2022-04-12T18:05:10Z","receivedAt":"2022-04-12T18:05:38Z","isPatch":false,"sender":{"key":"szeder.dev@gmail.com","avatar":"https://avatars.githubusercontent.com/u/116324?v=4"},"body":"On Tue, Apr 12, 2022 at 10:01:21AM -0700, Junio C Hamano wrote:\n> The latest maintenance release Git v2.35.2, together with releases\n> for older maintenance tracks v2.30.3, v2.31.2, v2.32.1, v2.33.2, and\n> v2.34.2, are now available at the usual places.\n> \n> These maintenance releases are to address the security issues\n> described in CVE-2022-24765.  Please update at your earliest\n> opportunity.\n> \n> The tarballs are found at:\n> \n>     https://www.kernel.org/pub/software/scm/git/\n> \n> The following public repositories all have a copy of the 'v2.35.2',\n> 'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3' tags.\n> \n>   url = https://git.kernel.org/pub/scm/git/git\n>   url = https://kernel.googlesource.com/pub/scm/git/git\n>   url = https://github.com/gitster/git\n> \n> CVE-2022-24765:\n>    On multi-user machines, Git users might find themselves\n>    unexpectedly in a Git worktree, e.g. when another user created a\n>    repository in `C:\\.git`, in a mounted network drive or in a\n>    scratch space. Merely having a Git-aware prompt that runs `git\n>    status` (or `git diff`) and navigating to a directory which is\n>    supposedly not a Git worktree, or opening such a directory in an\n>    editor or IDE such as VS Code or Atom, will potentially run\n>    commands defined by that other user.\n> \n> Credit for finding this vulnerability goes to 俞晨东; the fix was\n> authored by Johannes Schindelin.\n\nThis fix causes trouble when attempting to 'sudo make install' any\nnon-tagged Git revision:\n\n  $ git checkout v2.36.0-rc2 \n  HEAD is now at 11cfe55261 Git 2.36-rc2\n  $ git commit --allow-empty -m foo\n  [detached HEAD 237ee2a6ef] foo\n  $ make\n  GIT_VERSION = 2.36.0.rc2.1.g237ee2a6ef\n  [...]\n  $ sudo make install\n  GIT_VERSION = 2.36.0-rc2\n      CC version.o\n\n\n"},{"id":"453619","messageId":"xmqq1qy04iqa.fsf@gitster.g","threadId":"57715","inReplyTo":"xmqqv8veb5i6.fsf@gitster.g","subject":"[ANNOUNCE] Git v2.35.3 and below as a usability fix","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-14T00:22:05Z","receivedAt":"2022-04-14T00:22:15Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance releases Git v2.35.3, together with releases\nfor older maintenance tracks v2.30.4, v2.31.3, v2.32.2, v2.33.3,\nand v2.34.3, are now available at the usual places.\n\nThese maintenance releases are to address usability issues in the\nrecent releases 'v2.35.2', 'v2.34.2', 'v2.33.2', 'v2.32.1',\n'v2.31.2', and 'v2.30.3', where each \"safe\" directory has to be\nlisted on the safe.directory configuration variables.  A broader\nescape hatch has been added so that the value '*' can be used to\ndeclare \"my colleagues and their repositories I may ever visit are\nall trustworthy\".\n\nThe same fix appears in the tip of 'master' and all the integration\nbranches of the project above 'master', too.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the tags\nmentioned above in the first paragraph.\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = https://github.com/gitster/git\n\n\nCredit for the usability fix goes to Derrick Stolee.\n\n\n"}]}