| 1 | Git v2.30.9 Release Notes |
| 2 | ========================= |
| 3 | |
| 4 | This release addresses the security issues CVE-2023-25652, |
| 5 | CVE-2023-25815, and CVE-2023-29007. |
| 6 | |
| 7 | |
| 8 | Fixes since v2.30.8 |
| 9 | ------------------- |
| 10 | |
| 11 | * CVE-2023-25652: |
| 12 | |
| 13 | By feeding specially crafted input to `git apply --reject`, a |
| 14 | path outside the working tree can be overwritten with partially |
| 15 | controlled contents (corresponding to the rejected hunk(s) from |
| 16 | the given patch). |
| 17 | |
| 18 | * CVE-2023-25815: |
| 19 | |
| 20 | When Git is compiled with runtime prefix support and runs without |
| 21 | translated messages, it still used the gettext machinery to |
| 22 | display messages, which subsequently potentially looked for |
| 23 | translated messages in unexpected places. This allowed for |
| 24 | malicious placement of crafted messages. |
| 25 | |
| 26 | * CVE-2023-29007: |
| 27 | |
| 28 | When renaming or deleting a section from a configuration file, |
| 29 | certain malicious configuration values may be misinterpreted as |
| 30 | the beginning of a new configuration section, leading to arbitrary |
| 31 | configuration injection. |
| 32 | |
| 33 | Credit for finding CVE-2023-25652 goes to Ry0taK, and the fix was |
| 34 | developed by Taylor Blau, Junio C Hamano and Johannes Schindelin, |
| 35 | with the help of Linus Torvalds. |
| 36 | |
| 37 | Credit for finding CVE-2023-25815 goes to Maxime Escourbiac and |
| 38 | Yassine BENGANA of Michelin, and the fix was developed by Johannes |
| 39 | Schindelin. |
| 40 | |
| 41 | Credit for finding CVE-2023-29007 goes to André Baptista and Vítor Pinho |
| 42 | of Ethiack, and the fix was developed by Taylor Blau, and Johannes |
| 43 | Schindelin, with help from Jeff King, and Patrick Steinhardt. |