Git 2.14.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Sep 27, 2018 at 11:19 UTC
d0832b2847aa9669c09397c5639d7fe56abaf9fc
3 files changed
+18
-2
Documentation/RelNotes/2.14.5.txt
new
+16
@@ -0,0 +1,16 @@
1
+Git v2.14.5 Release Notes
2
+=========================
3
+
4
+This release is to address the recently reported CVE-2018-17456.
5
+
6
+Fixes since v2.14.4
7
+-------------------
8
+
9
+ * Submodules' "URL"s come from the untrusted .gitmodules file, but
10
+ we blindly gave it to "git clone" to clone submodules when "git
11
+ clone --recurse-submodules" was used to clone a project that has
12
+ such a submodule. The code has been hardened to reject such
13
+ malformed URLs (e.g. one that begins with a dash).
14
+
15
+Credit for finding and fixing this vulnerability goes to joernchen
16
+and Jeff King, respectively.
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.14.4
4
+DEF_VER=v2.14.5
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.14.4.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.14.5.txt
\ No newline at end of file