Git 2.30.6
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Taylor Blau committed
Sep 30, 2022 at 16:32 UTC
abd4d67ab0f84fff703fa14d9eebfd287b42daeb
3 files changed
+62
-2
Documentation/RelNotes/2.30.6.txt
new
+60
@@ -0,0 +1,60 @@
1
+Git v2.30.6 Release Notes
2
+=========================
3
+
4
+This release addresses the security issues CVE-2022-39253 and
5
+CVE-2022-39260.
6
+
7
+Fixes since v2.30.5
8
+-------------------
9
+
10
+ * CVE-2022-39253:
11
+ When relying on the `--local` clone optimization, Git dereferences
12
+ symbolic links in the source repository before creating hardlinks
13
+ (or copies) of the dereferenced link in the destination repository.
14
+ This can lead to surprising behavior where arbitrary files are
15
+ present in a repository's `$GIT_DIR` when cloning from a malicious
16
+ repository.
17
+
18
+ Git will no longer dereference symbolic links via the `--local`
19
+ clone mechanism, and will instead refuse to clone repositories that
20
+ have symbolic links present in the `$GIT_DIR/objects` directory.
21
+
22
+ Additionally, the value of `protocol.file.allow` is changed to be
23
+ "user" by default.
24
+
25
+ * CVE-2022-39260:
26
+ An overly-long command string given to `git shell` can result in
27
+ overflow in `split_cmdline()`, leading to arbitrary heap writes and
28
+ remote code execution when `git shell` is exposed and the directory
29
+ `$HOME/git-shell-commands` exists.
30
+
31
+ `git shell` is taught to refuse interactive commands that are
32
+ longer than 4MiB in size. `split_cmdline()` is hardened to reject
33
+ inputs larger than 2GiB.
34
+
35
+Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The
36
+fix was authored by Taylor Blau, with help from Johannes Schindelin.
37
+
38
+Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
39
+The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.
40
+
41
+
42
+Jeff King (2):
43
+ shell: add basic tests
44
+ shell: limit size of interactive commands
45
+
46
+Kevin Backhouse (1):
47
+ alias.c: reject too-long cmdline strings in split_cmdline()
48
+
49
+Taylor Blau (11):
50
+ builtin/clone.c: disallow `--local` clones with symlinks
51
+ t/lib-submodule-update.sh: allow local submodules
52
+ t/t1NNN: allow local submodules
53
+ t/2NNNN: allow local submodules
54
+ t/t3NNN: allow local submodules
55
+ t/t4NNN: allow local submodules
56
+ t/t5NNN: allow local submodules
57
+ t/t6NNN: allow local submodules
58
+ t/t7NNN: allow local submodules
59
+ t/t9NNN: allow local submodules
60
+ transport: make `protocol.file.allow` be "user" by default
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.30.5
4
+DEF_VER=v2.30.6
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.30.5.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.30.6.txt
\ No newline at end of file