{"thread":{"id":"63763","subject":"[ANNOUNCE] Git v2.50.1 and friends","startedAt":"2025-07-08T16:59:40Z","lastAt":"2025-07-08T16:59:40Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"521555","messageId":"xmqq5xg2wrd1.fsf@gitster.g","threadId":"63763","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.50.1 and friends","fromName":"Junio C Hamano","fromEmail":"junio@pobox.com","sentAt":"2025-07-08T16:59:38Z","receivedAt":"2025-07-08T16:59:40Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"A maintenance release Git v2.50.1 and others for older maintenance\ntracks down to maint-2.43 are now available at the usual places.\n\nThis is a set of coordinated security fix releases.  Please update\nat your earliest convenience.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the v2.43.7,\nv2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1 and v2.50.1\ntags:\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\n----------------------------------------------------------------\n\nGit v2.50.1 Release Notes\n=========================\n\nThis release merges up the fixes that appear in v2.43.7, v2.44.4,\nv2.45.4, v2.46.4, v2.47.3, v2.48.2, and v2.49.1 to address the\nfollowing CVEs: CVE-2025-27613, CVE-2025-27614, CVE-2025-46334,\nCVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and\nCVE-2025-48386. See the release notes for v2.43.7 for details.\n\n----------------------------------------------------------------\n\nGit v2.43.7 Release Notes\n=========================\n\nThis release includes fixes for CVE-2025-27613, CVE-2025-27614,\nCVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and\nCVE-2025-48386.\n\nFixes since v2.43.6\n-------------------\n\n * CVE-2025-27613, Gitk:\n\n   When a user clones an untrusted repository and runs Gitk without\n   additional command arguments, any writable file can be created and\n   truncated. The option \"Support per-file encoding\" must have been\n   enabled. The operation \"Show origin of this line\" is affected as\n   well, regardless of the option being enabled or not.\n\n * CVE-2025-27614, Gitk:\n\n   A Git repository can be crafted in such a way that a user who has\n   cloned the repository can be tricked into running any script\n   supplied by the attacker by invoking `gitk filename`, where\n   `filename` has a particular structure.\n\n * CVE-2025-46334, Git GUI (Windows only):\n\n   A malicious repository can ship versions of sh.exe or typical\n   textconv filter programs such as astextplain. On Windows, path\n   lookup can find such executables in the worktree. These programs\n   are invoked when the user selects \"Git Bash\" or \"Browse Files\" from\n   the menu.\n\n * CVE-2025-46835, Git GUI:\n\n   When a user clones an untrusted repository and is tricked into\n   editing a file located in a maliciously named directory in the\n   repository, then Git GUI can create and overwrite any writable\n   file.\n\n * CVE-2025-48384, Git:\n\n   When reading a config value, Git strips any trailing carriage\n   return and line feed (CRLF). When writing a config entry, values\n   with a trailing CR are not quoted, causing the CR to be lost when\n   the config is later read.  When initializing a submodule, if the\n   submodule path contains a trailing CR, the altered path is read\n   resulting in the submodule being checked out to an incorrect\n   location. If a symlink exists that points the altered path to the\n   submodule hooks directory, and the submodule contains an executable\n   post-checkout hook, the script may be unintentionally executed\n   after checkout.\n\n * CVE-2025-48385, Git:\n\n   When cloning a repository Git knows to optionally fetch a bundle\n   advertised by the remote server, which allows the server-side to\n   offload parts of the clone to a CDN. The Git client does not\n   perform sufficient validation of the advertised bundles, which\n   allows the remote side to perform protocol injection.\n\n   This protocol injection can cause the client to write the fetched\n   bundle to a location controlled by the adversary. The fetched\n   content is fully controlled by the server, which can in the worst\n   case lead to arbitrary code execution.\n\n * CVE-2025-48386, Git:\n\n   The wincred credential helper uses a static buffer (`target`) as a\n   unique key for storing and comparing against internal storage. This\n   credential helper does not properly bounds check the available\n   space remaining in the buffer before appending to it with\n   `wcsncat()`, leading to potential buffer overflows.\n\n----------------------------------------------------------------\n\nChanges since v2.50.0 are as follows:\n\nAvi Halachmi (:avih) (1):\n      gitk: encode arguments correctly with \"open\"\n\nJohannes Sixt (27):\n      gitk: treat file names beginning with \"|\" as relative paths\n      gitk: have callers of diffcmd supply pipe symbol when necessary\n      gitk: sanitize 'exec' arguments: simple cases\n      gitk: sanitize 'exec' arguments: 'eval exec'\n      gitk: sanitize 'exec' arguments: redirections\n      gitk: sanitize 'exec' arguments: redirections and background\n      gitk: sanitize 'exec' arguments: redirect to process\n      gitk: sanitize 'open' arguments: simple commands\n      gitk: sanitize 'open' arguments: simple commands with redirections\n      gitk: sanitize 'open' arguments: simple commands, readable and writable\n      gitk: collect construction of blameargs into a single conditional\n      gitk: sanitize 'open' arguments: command pipeline\n      git-gui: remove special treatment of Windows from open_cmd_pipe\n      git-gui: remove git config --list handling for git < 1.5.3\n      git-gui: treat file names beginning with \"|\" as relative paths\n      git-gui: sanitize 'exec' arguments: simple cases\n      git-gui: sanitize 'exec' arguments: background\n      git-gui: remove option --stderr from git_read\n      git-gui: break out a separate function git_read_nice\n      git-gui: use git_read in githook_read\n      gitk: sanitize 'open' arguments: revisit recently updated 'open' calls\n      git-gui: convert git_read*, git_write to be non-variadic\n      git-gui: pass redirections as separate argument to _open_stdout_stderr\n      git-gui: pass redirections as separate argument to git_read\n      git-gui: introduce function git_redir for git calls with redirections\n      git-gui: do not mistake command arguments as redirection operators\n      git-gui: sanitize 'exec' arguments: convert new 'cygpath' calls\n\nJunio C Hamano (2):\n      Git 2.49.1\n      Git 2.50.1\n\nJustin Tobler (1):\n      config: quote values containing CR character\n\nMark Levedahl (13):\n      git-gui: _which, only add .exe suffix if not present\n      git-gui: use [is_Windows], not bad _shellpath\n      git-gui: make _shellpath usable on startup\n      git-gui: remove Tcl 8.4 workaround on 2>@1 redirection\n      git-gui: use only the configured shell\n      git-gui: remove HEAD detachment implementation for git < 1.5.3\n      git-gui: remove unused proc is_shellscript\n      git-gui: avoid auto_execok for git-bash menu item\n      git-gui: avoid auto_execok in do_windows_shortcut\n      git-gui: cleanup git-bash menu item\n      git-gui: assure PATH has only absolute elements.\n      git-gui: sanitize $PATH on all platforms\n      git-gui: override exec and open only on Windows\n\nPatrick Steinhardt' via Git Security (1):\n      bundle-uri: fix arbitrary file writes via parameter injection\n\nTaylor Blau (7):\n      wincred: avoid buffer overflow in wcsncat()\n      Git 2.43.7\n      Git 2.44.4\n      Git 2.45.4\n      Git 2.46.4\n      Git 2.47.3\n      Git 2.48.2\n\n"}]}