threads / announce / 57715

[ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765

Subject: [ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765

## tl;dr

3 messages between Apr 12, 2022 and Apr 14, 2022.

replies: 2people: 2as markdown or json

Junio C Hamano· Apr 12, 2022, 17:01 UTC · lore

The latest maintenance release Git v2.35.2, together with releases for older maintenance tracks v2.30.3, v2.31.2, v2.32.1, v2.33.2, and v2.34.2, are now available at the usual places.

These maintenance releases are to address the security issues described in CVE-2022-24765. Please update at your earliest opportunity.

The tarballs are found at:
    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the 'v2.35.2', 'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3' tags.

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = https://github.com/gitster/git
CVE-2022-24765:
   On multi-user machines, Git users might find themselves
   unexpectedly in a Git worktree, e.g. when another user created a
   repository in `C:\.git`, in a mounted network drive or in a
   scratch space. Merely having a Git-aware prompt that runs `git
   status` (or `git diff`) and navigating to a directory which is
   supposedly not a Git worktree, or opening such a directory in an
   editor or IDE such as VS Code or Atom, will potentially run
   commands defined by that other user.

Credit for finding this vulnerability goes to 俞晨东; the fix was authored by Johannes Schindelin.

SZEDER Gábor· Apr 12, 2022, 18:05 UTC · re: Junio C Hamano · lore

Re: [ANNOUNCE] Git v2.35.2 and below for CVE-2022-24765

On Tue, Apr 12, 2022 at 10:01:21AM -0700, Junio C Hamano wrote:
Show 31 quoted lines
> The latest maintenance release Git v2.35.2, together with releases
> for older maintenance tracks v2.30.3, v2.31.2, v2.32.1, v2.33.2, and
> v2.34.2, are now available at the usual places.
> 
> These maintenance releases are to address the security issues
> described in CVE-2022-24765.  Please update at your earliest
> opportunity.
> 
> The tarballs are found at:
> 
>     https://www.kernel.org/pub/software/scm/git/
> 
> The following public repositories all have a copy of the 'v2.35.2',
> 'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3' tags.
> 
>   url = https://git.kernel.org/pub/scm/git/git
>   url = https://kernel.googlesource.com/pub/scm/git/git
>   url = https://github.com/gitster/git
> 
> CVE-2022-24765:
>    On multi-user machines, Git users might find themselves
>    unexpectedly in a Git worktree, e.g. when another user created a
>    repository in `C:\.git`, in a mounted network drive or in a
>    scratch space. Merely having a Git-aware prompt that runs `git
>    status` (or `git diff`) and navigating to a directory which is
>    supposedly not a Git worktree, or opening such a directory in an
>    editor or IDE such as VS Code or Atom, will potentially run
>    commands defined by that other user.
> 
> Credit for finding this vulnerability goes to 俞晨东; the fix was
> authored by Johannes Schindelin.

This fix causes trouble when attempting to 'sudo make install' any non-tagged Git revision:

  $ git checkout v2.36.0-rc2 
  HEAD is now at 11cfe55261 Git 2.36-rc2
  $ git commit --allow-empty -m foo
  [detached HEAD 237ee2a6ef] foo
  $ make
  GIT_VERSION = 2.36.0.rc2.1.g237ee2a6ef
  [...]
  $ sudo make install
  GIT_VERSION = 2.36.0-rc2
      CC version.o
Junio C Hamano· Apr 14, 2022, 00:22 UTC · re: Junio C Hamano · lore

[ANNOUNCE] Git v2.35.3 and below as a usability fix

The latest maintenance releases Git v2.35.3, together with releases for older maintenance tracks v2.30.4, v2.31.3, v2.32.2, v2.33.3, and v2.34.3, are now available at the usual places.

These maintenance releases are to address usability issues in the recent releases 'v2.35.2', 'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3', where each "safe" directory has to be listed on the safe.directory configuration variables. A broader escape hatch has been added so that the value '*' can be used to declare "my colleagues and their repositories I may ever visit are all trustworthy".

The same fix appears in the tip of 'master' and all the integration branches of the project above 'master', too.

The tarballs are found at:
    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the tags mentioned above in the first paragraph.

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = https://github.com/gitster/git
Credit for the usability fix goes to Derrick Stolee.

← back to recent threads