Hi Git dev team,
we've noted above critical CVE (CVSS 10.0) and wanted to inquire about any possible dependencies for the (2.53.0) x64 version of Git for Windows and any fix perspective. Given Git is not a Google tool it should be quick to decide and respond to.
The CVE relates to packet crypto/tls in the standard library of Go (Golang). Impacted software: Go-versions prior to 1.26.0-rc.1 plus distros based on it (e.g. Debian Bullseye/Bookworm, RHEL 10, Ubuntu).
How can we ensure the latest Git version is not or no longer impacted by this CV?
Kind regards Jan.Matthiesen@bwi.de