git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Request for Curl.exe update included in Git binaries

From
brian m. carlson <sandals@crustytoothpaste.net>
Date
Sep 25, 2023, 21:54 UTC
Message-ID
<ZRIBmxT4mh5Rlt3-@tapette.crustytoothpaste.net>
In-Reply-To
<IA1PR02MB9088F7E0AB55FE03CF0C38B186FCA@IA1PR02MB9088.namprd02.prod.outlook.com>
On 2023-09-25 at 15:37:46, Robert Smith wrote:
> Hello,
Hey,
Show 5 quoted lines
> Regarding this CVE:
> 
> https://curl.se/docs/CVE-2023-38039.html
> 
> Is there any plan to update Git for Windows to include the updated 8.3.0 Curl binaries?

The Git project doesn't ship any binaries at all, and we don't ship curl. Git for Windows does ship a substantial amount of other software, including curl. You can find their issue tracker at https://github.com/git-for-windows/git/issues, but I believe this has already been fixed in https://github.com/git-for-windows/git/issues/4605 and will be included in the next version.

I'm not certain about their release policy, but I seem to recall that they don't issue updates for dependent packages until a new release would normally be done. To be certain, you'd have to inquire with them.

-- 
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
Previous: Robert SmithNext: Johannes Schindelin
Message 2 of 3 in “Request for Curl.exe update included in Git binaries”
  1. Robert SmithSep 25, 2023
  2. brian m. carlsonSep 25, 2023
  3. Johannes SchindelinSep 26, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.