git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387

From
Junio C Hamano <gitster@pobox.com>
Date
Jul 10, 2024, 17:10 UTC
Message-ID
<xmqqa5ipxjdr.fsf@gitster.g>
In-Reply-To
<ffe00b81-5f19-a073-9a9e-ee84b7d3845b@gmx.de>
Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:
Show 8 quoted lines
> The crucial part is the `sshd` part. Git for Windows does distribute the
> `sshd.exe` binary, but it is in no way used by default, nor is there
> support how to set it up to run an SSH server.
>
> Git for Windows is therefore not affected by this vulnerability, and
> therefore it is not crucial to get a new version out as quickly as
> possible. See also my assessment at
> https://github.com/git-for-windows/git/issues/5031#issuecomment-2199722969

I think I've seen in the past another inquiry about vulnerability in OpenSSH, which turned out to be irrelevant in the context of Git for Windows for this exact reason (i.e. "sshd" is problematic but "ssh" is OK).

Would it make future confusion like this less likely if you stopped shipping the sshd and ship only the ssh client?

Thanks.
Previous: Johannes SchindelinNext: Dragan Simic
Message 2 of 5 in “Re: Request to Update OpenSSH Version in Git due to Security Vulnerabilities (CVE-2006-5051, CVE-2024-6387”
  1. Johannes SchindelinJul 10, 2024
  2. Junio C HamanoJul 10, 2024
  3. Dragan SimicJul 10, 2024
  4. Johannes SchindelinJul 22, 2024
  5. Dragan SimicJul 23, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.