Git 2.13.7
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
May 22, 2018 at 13:50 UTC
0114f71344844be9e5add321cffea34bac077d75
3 files changed
+22
-2
Documentation/RelNotes/2.13.7.txt
new
+20
@@ -0,0 +1,20 @@
1
+Git v2.13.7 Release Notes
2
+=========================
3
+
4
+Fixes since v2.13.6
5
+-------------------
6
+
7
+ * Submodule "names" come from the untrusted .gitmodules file, but we
8
+ blindly append them to $GIT_DIR/modules to create our on-disk repo
9
+ paths. This means you can do bad things by putting "../" into the
10
+ name. We now enforce some rules for submodule names which will cause
11
+ Git to ignore these malicious names (CVE-2018-11235).
12
+
13
+ Credit for finding this vulnerability and the proof of concept from
14
+ which the test script was adapted goes to Etienne Stalmans.
15
+
16
+ * It was possible to trick the code that sanity-checks paths on NTFS
17
+ into reading random piece of memory (CVE-2018-11233).
18
+
19
+Credit for fixing for these bugs goes to Jeff King, Johannes
20
+Schindelin and others.
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.13.6
4
+DEF_VER=v2.13.7
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.13.6.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.13.7.txt
\ No newline at end of file