{"thread":{"id":"59651","subject":"[ANNOUNCE] Git for Windows 2.40.1","startedAt":"2023-04-25T17:18:06Z","lastAt":"2023-04-25T17:18:06Z","messageCount":1,"participants":["Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"476040","messageId":"20230425171756.3852-1-johannes.schindelin@gmx.de","threadId":"59651","inReplyTo":null,"subject":"[ANNOUNCE] Git for Windows 2.40.1","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2023-04-25T17:17:56Z","receivedAt":"2023-04-25T17:18:06Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Dear Git users,\n\nI hereby announce that Git for Windows 2.40.1 is available from:\n\n    https://gitforwindows.org/\n\nChanges since Git for Windows v2.40.0 (March 14th 2023)\n\nThis is a security release, addressing CVE-2023-29012, CVE-2023-29011,\nCVE-2023-29007, CVE-2023-25815 and CVE-2023-25652.\n\nAs announced previously, Git for Windows will drop support for Windows\n7 and for Windows 8 in one of the next versions, following Cygwin's and\nMSYS2's lead (Git for Windows relies on MSYS2 for components such as\nBash and Perl).\n\nAlso following the footsteps of the MSYS2 and Cygwin projects on which\nGit for Windows depends, the 32-bit variant of Git for Windows is\nnearing its end of support.\n\nNew Features\n\n  * Comes with Git v2.40.1.\n\nBug Fixes\n\n  * Addresses CVE-2023-29012, a vulnerability where starting Git CMD\n    would execute doskey.exe in the current directory, if it exists.\n  * Addresses CVE-2023-29011, a vulnerability where the SOCKS5 proxy\n    called connect.exe is susceptible to picking up an untrusted\n    configuration on multi-user machines.\n  * Addresses CVE-2023-29007, a vulnerability where git submodule\n    deinit can inadvertently introduce malicious changes into the Git\n    config file.\n  * Addresses CVE-2023-25815, a vulnerability where Git can\n    unexpectedly show crafted \"localized\" messages written by another\n    user on a multi-user machine.\n  * Addresses CVE-2023-25652, a vulnerability where git apply --reject\n    could follow symbolic links to write files outside the worktree.\n\nGit-2.40.1-64-bit.exe | d2f0fbf9d84622b2aa4aed401daf6dedb8ac89bb388af02078ba375496a873dc\nGit-2.40.1-32-bit.exe | 3ee2289a4f6e9917f702bd032a67874c11aa05bf2d28d967986e40d4f7f50636\nPortableGit-2.40.1-64-bit.7z.exe | 9e1d819aef3284420adf6d923b0d4865254bd403641d915975e49ddea1e7cdf9\nPortableGit-2.40.1-32-bit.7z.exe | e1360e94cb292862fb023018578a1029022a09278b160f7264c6dc444f65c9ca\nMinGit-2.40.1-64-bit.zip | 36498716572394918625476ca207df3d5f8b535a669e9aad7a99919d0179848c\nMinGit-2.40.1-32-bit.zip | 8bfc48e5211cc209768297e0b71c253b2d8393875d7b3daef8c54909634daa16\nMinGit-2.40.1-busybox-64-bit.zip | 8c829d6f3ae0d48e5939b7ddccbaea44b8ef2a38f9e28c3afa691e0451432b14\nMinGit-2.40.1-busybox-32-bit.zip | e31c73c0b7d3546fba54e9416bf4ce850ea7e528eb6c8b059fdd941ad78749c7\nGit-2.40.1-64-bit.tar.bz2 | 249b3f31b14b802c26e64f082131fe3346af7de204a897438a0027b67fdcd0b7\nGit-2.40.1-32-bit.tar.bz2 | be7c1b51bc30187a28d77e5f71e5bbcd768b2d0021ba11ad26178f08920533fb\n\nCiao,\nJohannes\n"}]}