{"thread":{"id":"59240","subject":"[Announce] Git 2.39.2 and friends","startedAt":"2023-02-14T18:05:13Z","lastAt":"2023-02-14T18:53:59Z","messageCount":2,"participants":["Junio C Hamano","rsbecker@nexbridge.com"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"472064","messageId":"xmqqr0us5dio.fsf@gitster.g","threadId":"59240","inReplyTo":null,"subject":"[Announce] Git 2.39.2 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2023-02-14T18:05:03Z","receivedAt":"2023-02-14T18:05:13Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"A maintenance release Git v2.39.2, together with releases for older\nmaintenance tracks v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7,\nv2.33.7, v2.32.6, v2.31.7, and v2.30.8, are now available at the\nusual places.\n\nThese maintenance releases are to address two security issues\nidentified as CVE-2023-22490 and CVE-2023-23946.  They both affect\nranges of existing versions and users are strongly encouraged to\nupgrade.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.39.2'\ntag, as well as the tags for older maintenance tracks listed above.\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\nThe addressed issues are:\n\n * CVE-2023-22490:\n\n   Using a specially-crafted repository, Git can be tricked into using\n   its local clone optimization even when using a non-local transport.\n   Though Git will abort local clones whose source $GIT_DIR/objects\n   directory contains symbolic links (c.f., CVE-2022-39253), the objects\n   directory itself may still be a symbolic link.\n\n   These two may be combined to include arbitrary files based on known\n   paths on the victim's filesystem within the malicious repository's\n   working copy, allowing for data exfiltration in a similar manner as\n   CVE-2022-39253.\n\n * CVE-2023-23946:\n\n   By feeding a crafted input to \"git apply\", a path outside the\n   working tree can be overwritten as the user who is running \"git\n   apply\".\n\nCredit for finding CVE-2023-22490 goes to yvvdwf, and the fix was\ndeveloped by Taylor Blau, with additional help from others on the\nGit security mailing list.\n\nCredit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the\nfix was developed by Patrick Steinhardt.\n\nJohannes Schindelin helped greatly in packaging the whole thing and\nproofreading the result.\n\nThanks.\n"},{"id":"472071","messageId":"004a01d940a4$289e56a0$79db03e0$@nexbridge.com","threadId":"59240","inReplyTo":"xmqqr0us5dio.fsf@gitster.g","subject":"RE: [Announce] Git 2.39.2 and friends","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2023-02-14T18:42:52Z","receivedAt":"2023-02-14T18:53:59Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On February 14, 2023 1:05 PM, Junio C Hamano wrote:\n>A maintenance release Git v2.39.2, together with releases for older\nmaintenance\n>tracks v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6,\nv2.31.7, and\n>v2.30.8, are now available at the usual places.\n>\n>These maintenance releases are to address two security issues identified as\nCVE-\n>2023-22490 and CVE-2023-23946.  They both affect ranges of existing\nversions and\n>users are strongly encouraged to upgrade.\n>\n>The tarballs are found at:\n>\n>    https://www.kernel.org/pub/software/scm/git/\n>\n>The following public repositories all have a copy of the 'v2.39.2'\n>tag, as well as the tags for older maintenance tracks listed above.\n>\n>  url = https://git.kernel.org/pub/scm/git/git\n>  url = https://kernel.googlesource.com/pub/scm/git/git\n>  url = git://repo.or.cz/alt-git.git\n>  url = https://github.com/gitster/git\n>\n>The addressed issues are:\n>\n> * CVE-2023-22490:\n>\n>   Using a specially-crafted repository, Git can be tricked into using\n>   its local clone optimization even when using a non-local transport.\n>   Though Git will abort local clones whose source $GIT_DIR/objects\n>   directory contains symbolic links (c.f., CVE-2022-39253), the objects\n>   directory itself may still be a symbolic link.\n>\n>   These two may be combined to include arbitrary files based on known\n>   paths on the victim's filesystem within the malicious repository's\n>   working copy, allowing for data exfiltration in a similar manner as\n>   CVE-2022-39253.\n>\n> * CVE-2023-23946:\n>\n>   By feeding a crafted input to \"git apply\", a path outside the\n>   working tree can be overwritten as the user who is running \"git\n>   apply\".\n>\n>Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was developed\nby\n>Taylor Blau, with additional help from others on the Git security mailing\nlist.\n>\n>Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the fix\nwas\n>developed by Patrick Steinhardt.\n>\n>Johannes Schindelin helped greatly in packaging the whole thing and\nproofreading\n>the result.\n\nNonStop build/test/package cycle has started for 2.39.2. If anyone needs one\nof the friends built for this platform, please let me know.\n--Randall\n\n"}]}