Git 2.43.7
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Taylor Blau committed
May 28, 2025 at 14:42 UTC
7a1903ad46b5cc7524c0734a5034dccaec07209b
3 files changed
+75
-2
Documentation/RelNotes/2.43.7.txt
new
+73
@@ -0,0 +1,73 @@
1
+Git v2.43.7 Release Notes
2
+=========================
3
+
4
+This release includes fixes for CVE-2025-27613, CVE-2025-27614,
5
+CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and
6
+CVE-2025-48386.
7
+
8
+Fixes since v2.43.6
9
+-------------------
10
+
11
+ * CVE-2025-27613, Gitk:
12
+
13
+ When a user clones an untrusted repository and runs Gitk without
14
+ additional command arguments, any writable file can be created and
15
+ truncated. The option "Support per-file encoding" must have been
16
+ enabled. The operation "Show origin of this line" is affected as
17
+ well, regardless of the option being enabled or not.
18
+
19
+ * CVE-2025-27614, Gitk:
20
+
21
+ A Git repository can be crafted in such a way that a user who has
22
+ cloned the repository can be tricked into running any script
23
+ supplied by the attacker by invoking `gitk filename`, where
24
+ `filename` has a particular structure.
25
+
26
+ * CVE-2025-46334, Git GUI (Windows only):
27
+
28
+ A malicious repository can ship versions of sh.exe or typical
29
+ textconv filter programs such as astextplain. On Windows, path
30
+ lookup can find such executables in the worktree. These programs
31
+ are invoked when the user selects "Git Bash" or "Browse Files" from
32
+ the menu.
33
+
34
+ * CVE-2025-46835, Git GUI:
35
+
36
+ When a user clones an untrusted repository and is tricked into
37
+ editing a file located in a maliciously named directory in the
38
+ repository, then Git GUI can create and overwrite any writable
39
+ file.
40
+
41
+ * CVE-2025-48384, Git:
42
+
43
+ When reading a config value, Git strips any trailing carriage
44
+ return and line feed (CRLF). When writing a config entry, values
45
+ with a trailing CR are not quoted, causing the CR to be lost when
46
+ the config is later read. When initializing a submodule, if the
47
+ submodule path contains a trailing CR, the altered path is read
48
+ resulting in the submodule being checked out to an incorrect
49
+ location. If a symlink exists that points the altered path to the
50
+ submodule hooks directory, and the submodule contains an executable
51
+ post-checkout hook, the script may be unintentionally executed
52
+ after checkout.
53
+
54
+ * CVE-2025-48385, Git:
55
+
56
+ When cloning a repository Git knows to optionally fetch a bundle
57
+ advertised by the remote server, which allows the server-side to
58
+ offload parts of the clone to a CDN. The Git client does not
59
+ perform sufficient validation of the advertised bundles, which
60
+ allows the remote side to perform protocol injection.
61
+
62
+ This protocol injection can cause the client to write the fetched
63
+ bundle to a location controlled by the adversary. The fetched
64
+ content is fully controlled by the server, which can in the worst
65
+ case lead to arbitrary code execution.
66
+
67
+ * CVE-2025-48386, Git:
68
+
69
+ The wincred credential helper uses a static buffer (`target`) as a
70
+ unique key for storing and comparing against internal storage. This
71
+ credential helper does not properly bounds check the available
72
+ space remaining in the buffer before appending to it with
73
+ `wcsncat()`, leading to potential buffer overflows.
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.43.6
4
+DEF_VER=v2.43.7
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.43.6.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.43.7.txt
\ No newline at end of file