{"thread":{"id":"60264","subject":"Request for Curl.exe update included in Git binaries","startedAt":"2023-09-25T15:37:51Z","lastAt":"2023-09-26T13:53:28Z","messageCount":3,"participants":["Robert Smith","brian m. carlson","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"482281","messageId":"IA1PR02MB9088F7E0AB55FE03CF0C38B186FCA@IA1PR02MB9088.namprd02.prod.outlook.com","threadId":"60264","inReplyTo":null,"subject":"Request for Curl.exe update included in Git binaries","fromName":"Robert Smith","fromEmail":"robsmi_ms@hotmail.com","sentAt":"2023-09-25T15:37:46Z","receivedAt":"2023-09-25T15:37:51Z","isPatch":false,"sender":{"key":"robsmi_ms@hotmail.com","avatar":null},"body":"Hello,\n\nRegarding this CVE:\n\nhttps://curl.se/docs/CVE-2023-38039.html\n\nIs there any plan to update Git for Windows to include the updated 8.3.0 Curl binaries?\n\nThanks,\n\nRobert S."},{"id":"482308","messageId":"ZRIBmxT4mh5Rlt3-@tapette.crustytoothpaste.net","threadId":"60264","inReplyTo":"IA1PR02MB9088F7E0AB55FE03CF0C38B186FCA@IA1PR02MB9088.namprd02.prod.outlook.com","subject":"Re: Request for Curl.exe update included in Git binaries","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2023-09-25T21:54:35Z","receivedAt":"2023-09-25T21:54:41Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2023-09-25 at 15:37:46, Robert Smith wrote:\n> Hello,\n\nHey,\n\n> Regarding this CVE:\n> \n> https://curl.se/docs/CVE-2023-38039.html\n> \n> Is there any plan to update Git for Windows to include the updated 8.3.0 Curl binaries?\n\nThe Git project doesn't ship any binaries at all, and we don't ship\ncurl.  Git for Windows does ship a substantial amount of other software,\nincluding curl.  You can find their issue tracker at\nhttps://github.com/git-for-windows/git/issues, but I believe this has\nalready been fixed in https://github.com/git-for-windows/git/issues/4605\nand will be included in the next version.\n\nI'm not certain about their release policy, but I seem to recall that\nthey don't issue updates for dependent packages until a new release\nwould normally be done.  To be certain, you'd have to inquire with them.\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"482335","messageId":"45a55b80-1a58-7a7a-bed2-250cf7b55f99@gmx.de","threadId":"60264","inReplyTo":"ZRIBmxT4mh5Rlt3-@tapette.crustytoothpaste.net","subject":"Re: Request for Curl.exe update included in Git binaries","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2023-09-26T13:53:10Z","receivedAt":"2023-09-26T13:53:28Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi brian and Robert,\n\nOn Mon, 25 Sep 2023, brian m. carlson wrote:\n\n> On 2023-09-25 at 15:37:46, Robert Smith wrote:\n>\n> > Regarding this CVE:\n> >\n> > https://curl.se/docs/CVE-2023-38039.html\n\nIn the future, please consider sending security-relevant enquiries to\ngit-security@googlegroups.com instead of the regular Git mailing list.\n\nIn this case, not much harm was done, but let's not risk anything. I say\nnot much harm was done because that CVE would appear to be very low risk.\nThe cURL project itself says this:\n\n\tWhen curl retrieves an HTTP response, it stores the incoming\n\theaders so that they can be accessed later via the libcurl headers\n\tAPI.\n\n\tHowever, curl did not have a limit on the size or quantity of\n\theaders it would accept in a response, allowing a malicious server\n\tto stream an endless series of headers to a client and eventually\n\tcause curl to run out of heap memory.\n\nSo the most damage that can be done by exploiting this vulnerability is to\nhost a Git server from which a user targeted by the attack simply cannot\nclone because the process will fail with an out-of-memory condition.\n\nThe Git for Windows project carefully vets any security updates of any of\nthe components distributed with Git for Windows, and if it is determined\nthat they constitute a vulnerability that can be exploited via regular Git\nusage, we aim to release a new version as swiftly as possible.\n\nIn this instance, it was determined that the severity is low (deviating\nfrom cURL's assessment because Git's usage of libcurl has a narrower focus\nthan general cURL usage), and no new Git for Windows version was deemed\nnecessary.\n\n> > Is there any plan to update Git for Windows to include the updated\n> > 8.3.0 Curl binaries?\n\nEver since https://github.com/git-for-windows/git/issues/4605 was\naddressed, the v8.3.0 cURL binaries have been ready to go for the next Git\nfor Windows version.\n\n> The Git project doesn't ship any binaries at all, and we don't ship\n> curl.  Git for Windows does ship a substantial amount of other software,\n> including curl.  You can find their issue tracker at\n> https://github.com/git-for-windows/git/issues, but I believe this has\n> already been fixed in https://github.com/git-for-windows/git/issues/4605\n> and will be included in the next version.\n\nPrecisely.\n\n> I'm not certain about their release policy,\n\nGit for Windows' release policy is documented at\nhttps://github.com/git-for-windows/git/security/policy.\n\n> but I seem to recall that they don't issue updates for dependent\n> packages until a new release would normally be done.  To be certain,\n> you'd have to inquire with them.\n\nGit for Windows does follow \"upstream\" Git releases. That is, every\nofficial Git version on the latest major version release train is followed\nshortly thereafter with a corresponding Git for Windows version.\n\nAs documented at\nhttps://github.com/git-for-windows/git/security/policy#version-number-scheme\nsometimes Git for Windows releases versions that do _not_ correspond to\nupstream Git versions. Reasons for that include security bug fixes in\ndependencies that affect Git usage, and bug fixes that are specific to Git\nfor Windows which are considered important enough to deliver to Git for\nWindows users as quickly as possible.\n\nIn this instance, I do not see any reason to risk upgrade fatigue and\nexpect to publish the first Git for Windows version that includes cURL\nv8.3.0 in the wake of Git v2.43.0 (slated for November 20th, 2023, see\nhttps://gh.io/gitCal).\n\nRobert, if you still feel very strongly that you need to have a Git for\nWindows that includes an updated `curl.exe`, I invite you to install the\nlatest snapshot at https://wingit.blob.core.windows.net/files/index.html.\nThese snapshots are designed to be as robust and dependable as full Git\nfor Windows releases, the only difference being that snapshots are\nreleased with every update to Git for Windows' `main` branch, i.e. at a\nmuch faster cadence than official Git for Windows versions.\n\nCiao,\nJohannes\n"}]}