Git 2.17.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Mar 17, 2020 at 13:23 UTC
c42c0f12972194564f039dcf580d89ca14ae72d6
3 files changed
+18
-2
Documentation/RelNotes/2.17.4.txt
new
+16
@@ -0,0 +1,16 @@
1
+Git v2.17.4 Release Notes
2
+=========================
3
+
4
+This release is to address the security issue: CVE-2020-5260
5
+
6
+Fixes since v2.17.3
7
+-------------------
8
+
9
+ * With a crafted URL that contains a newline in it, the credential
10
+ helper machinery can be fooled to give credential information for
11
+ a wrong host. The attack has been made impossible by forbidding
12
+ a newline character in any value passed via the credential
13
+ protocol.
14
+
15
+Credit for finding the vulnerability goes to Felix Wilhelm of Google
16
+Project Zero.
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.17.3
4
+DEF_VER=v2.17.4
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.17.3.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.17.4.txt
\ No newline at end of file