{"thread":{"id":"59650","subject":"[ANNOUNCE] Git v2.40.1 and friends","startedAt":"2023-04-25T17:06:24Z","lastAt":"2023-04-25T17:06:24Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"476039","messageId":"xmqqa5yv3n93.fsf@gitster.g","threadId":"59650","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.40.1 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2023-04-25T17:06:16Z","receivedAt":"2023-04-25T17:06:24Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"A maintenance release Git v2.40.1, together with releases for older\nmaintenance tracks v2.39.3, v2.38.5, v2.37.7, v2.36.6, v2.35.8,\nv2.34.8, v2.33.8, v2.32.7, v2.31.8, and v2.30.9, are now available\nat the usual places.\n\nThese maintenance releases are to address security issues identified\nas CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007.  They affect\nranges of existing versions and users are encouraged to upgrade.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.40.1'\ntag, as well as the tags for older maintenance tracks listed above:\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\nThe addressed issues are:\n\n * CVE-2023-25652:\n\n   By feeding specially crafted input to `git apply --reject`, a\n   path outside the working tree can be overwritten with partially\n   controlled contents (corresponding to the rejected hunk(s) from\n   the given patch).\n\n * CVE-2023-25815:\n\n   When Git is compiled with runtime prefix support and runs without\n   translated messages, it still used the gettext machinery to\n   display messages, which subsequently potentially looked for\n   translated messages in unexpected places. This allowed for\n   malicious placement of crafted messages.\n\n * CVE-2023-29007:\n\n   When renaming or deleting a section from a configuration file,\n   certain malicious configuration values may be misinterpreted as\n   the beginning of a new configuration section, leading to arbitrary\n   configuration injection.\n\nCredit for finding CVE-2023-25652 goes to Ry0taK, and the fix was\ndeveloped by Taylor Blau, Junio C Hamano and Johannes Schindelin,\nwith the help of Linus Torvalds.\n\nCredit for finding CVE-2023-25815 goes to Maxime Escourbiac and\nYassine BENGANA of Michelin, and the fix was developed by Johannes\nSchindelin.\n\nCredit for finding CVE-2023-29007 goes to André Baptista and Vítor Pinho\nof Ethiack, and the fix was developed by Taylor Blau, and Johannes\nSchindelin, with help from Jeff King, and Patrick Steinhardt.\n\nThanks.\n"}]}