{"thread":{"id":"59103","subject":"[ANNOUNCE] Git 2.39.1 and others","startedAt":"2023-01-17T18:34:50Z","lastAt":"2023-01-18T07:05:40Z","messageCount":3,"participants":["Junio C Hamano","Ramsay Jones"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"470523","messageId":"xmqq7cxl9h0i.fsf@gitster.g","threadId":"59103","inReplyTo":null,"subject":"[ANNOUNCE] Git 2.39.1 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2023-01-17T18:02:05Z","receivedAt":"2023-01-17T18:34:50Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"A maintenance release v2.39.1, together with releases for older\nmaintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6,\nv2.33.6, v2.32.5, v2.31.6, and v2.30.7, are now available at the\nusual places.\n\nThese maintenance releases are to address the security issues\nidentified as CVE-2022-41903 and CVE-2022-23521.\n\nThe tarballs are found at:\n\n https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the v2.39.1\ntag, as well as the tags for older maintenance tracks for v2.30.7,\nv2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, and\nv2.38.3.\n\n url = https://git.kernel.org/pub/scm/git/git\n url = https://kernel.googlesource.com/pub/scm/git/git\n url = git://repo.or.cz/alt-git.git\n url = https://github.com/gitster/git\n\n * CVE-2022-41903:\n\n git log has the ability to display commits using an arbitrary\n format with its --format specifiers. This functionality is also\n exposed to git archive via the export-subst gitattribute.\n\n When processing the padding operators (e.g., %<(, %<|(, %>(,\n %>>(, or %><( ), an integer overflow can occur in\n pretty.c::format_and_pad_commit() where a size_t is improperly\n stored as an int, and then added as an offset to a subsequent\n memcpy() call.\n\n This overflow can be triggered directly by a user running a\n command which invokes the commit formatting machinery (e.g., git\n log --format=...). It may also be triggered indirectly through\n git archive via the export-subst mechanism, which expands format\n specifiers inside of files within the repository during a git\n archive.\n\n This integer overflow can result in arbitrary heap writes, which\n may result in remote code execution.\n\n* CVE-2022-23521:\n\n gitattributes are a mechanism to allow defining attributes for\n paths. These attributes can be defined by adding a `.gitattributes`\n file to the repository, which contains a set of file patterns and\n the attributes that should be set for paths matching this pattern.\n\n When parsing gitattributes, multiple integer overflows can occur\n when there is a huge number of path patterns, a huge number of\n attributes for a single pattern, or when the declared attribute\n names are huge.\n\n These overflows can be triggered via a crafted `.gitattributes` file\n that may be part of the commit history. Git silently splits lines\n longer than 2KB when parsing gitattributes from a file, but not when\n parsing them from the index. Consequentially, the failure mode\n depends on whether the file exists in the working tree, the index or\n both.\n\n This integer overflow can result in arbitrary heap reads and writes,\n which may result in remote code execution.\n\nCredit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.\nAn initial fix was authored by Markus Vervier of X41 D-Sec. Credit for\nfinding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41\nD-Sec. This work was sponsored by OSTIF.\n\nThe proposed fixes have been polished and extended to cover additional\nfindings by Patrick Steinhardt of GitLab, with help from others on the\nGit security mailing list.\n"},{"id":"470552","messageId":"3b79e8c2-ddb2-fa6f-db6f-1f3cae31a729@ramsayjones.plus.com","threadId":"59103","inReplyTo":"xmqq7cxl9h0i.fsf@gitster.g","subject":"Re: [ANNOUNCE] Git 2.39.1 and others","fromName":"Ramsay Jones","fromEmail":"ramsay@ramsayjones.plus.com","sentAt":"2023-01-17T22:35:02Z","receivedAt":"2023-01-17T22:52:01Z","isPatch":false,"sender":{"key":"ramsay@ramsayjones.plus.com","avatar":"https://avatars.githubusercontent.com/u/33702710?v=4"},"body":"\n\nOn 17/01/2023 18:02, Junio C Hamano wrote:\n> A maintenance release v2.39.1, together with releases for older\n> maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6,\n> v2.33.6, v2.32.5, v2.31.6, and v2.30.7, are now available at the\n> usual places.\n\nFYI:\n\n$ git tag -v v2.30.7\nobject b7b37a33711e64bf580ef3141878b12a36e28833\ntype commit\ntag v2.30.7\ntagger Junio C Hamano 1670933134 +0900\n\nGit 2.30.7\ngpg: Signature made 13 Dec 2022 12:05:34 GMT\ngpg: using RSA key B0B5E88696AFE6CB\ngpg: Good signature from \"Junio C Hamano \"\ngpg: aka \"Junio C Hamano \"\ngpg: aka \"Junio C Hamano \"\ngpg: WARNING: This key is not certified with a trusted signature!\ngpg: There is no indication that the signature belongs to the owner.\nPrimary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7\n Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB\n\n$ git tag -v v2.31.6\nobject 82689d5e5d3f41da2ab1fbf9fbe7aacfd6da74c1\ntype commit\ntag v2.31.6\ntagger Junio C Hamano 1670933242 +0900\n\nGit 2.31.6\nerror: no signature found\n\n$ git tag -v v2.32.5\nobject d96ea538e8dd0fcf381089a3b09c0a9af3617351\ntype commit\ntag v2.32.5\ntagger Junio C Hamano 1670933456 +0900\n\nGit 2.32.5\nerror: no signature found\n\n$ git tag -v v2.33.6\nobject 7fe9bf55b84d2610a7ac09893b25ef188f145a21\ntype commit\ntag v2.33.6\ntagger Junio C Hamano 1670933643 +0900\n\nGit 2.33.6\nerror: no signature found\n\n$ git tag -v v2.34.6\nobject 6c9466944c90c236217ec6f9ce5ed6b0e73903f9\ntype commit\ntag v2.34.6\ntagger Junio C Hamano 1670933752 +0900\n\nGit 2.34.6\nerror: no signature found\n\n$ git tag -v v2.35.6\nobject 02f498172348f7ba9dceb169305b74c7eca7a38d\ntype commit\ntag v2.35.6\ntagger Junio C Hamano 1670933877 +0900\n\nGit 2.35.6\nerror: no signature found\n\n$ git tag -v v2.36.4\nobject ad949b24f8d6ee4767c07794a2f01ada91b46b74\ntype commit\ntag v2.36.4\ntagger Junio C Hamano 1670933982 +0900\n\nGit 2.36.4\nerror: no signature found\n\n$ git tag -v v2.37.5\nobject e43ac5f23d3231f6433558931296d555592e978a\ntype commit\ntag v2.37.5\ntagger Junio C Hamano 1670934063 +0900\n\nGit 2.37.5\nerror: no signature found\n\n$ git tag -v v2.38.3\nobject 37ed7bf0f13d204ccb6b8e7e2fbcf7b3bf13e25c\ntype commit\ntag v2.38.3\ntagger Junio C Hamano 1670934268 +0900\n\nGit 2.38.3\nerror: no signature found\n\n$ git tag -v v2.39.1\nobject 01443f01b7c6a3c6ef03268b649b119027743115\ntype commit\ntag v2.39.1\ntagger Junio C Hamano 1670934343 +0900\n\nGit 2.39.1\nerror: no signature found\n\n$ \n\n\nATB,\nRamsay Jones\n\n\n"},{"id":"470583","messageId":"xmqqa62g8i6u.fsf@gitster.g","threadId":"59103","inReplyTo":"3b79e8c2-ddb2-fa6f-db6f-1f3cae31a729@ramsayjones.plus.com","subject":"Re: [ANNOUNCE] Git 2.39.1 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2023-01-18T06:34:17Z","receivedAt":"2023-01-18T07:05:40Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Ramsay Jones writes:\n\n> $ git tag -v v2.31.6\n> object 82689d5e5d3f41da2ab1fbf9fbe7aacfd6da74c1\n> type commit\n> tag v2.31.6\n> tagger Junio C Hamano 1670933242 +0900\n>\n> Git 2.31.6\n> error: no signature found\n\nOops. Corrected. Thanks.\n"}]}