diff options
author | Junio C Hamano <gitster@pobox.com> | 2024-05-14 07:53:46 -0700 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2024-05-14 07:53:46 -0700 |
commit | 81632a6851a67a669f4118f317c4c317597f3580 (patch) | |
tree | d2134236e1e1eeac75b067ffea4f230cae79baa8 /RelNotes | |
parent | 1365ca3bda21f91694f354abdb3459692fcbcf1c (diff) | |
download | git-htmldocs-81632a6851a67a669f4118f317c4c317597f3580.tar.gz |
Autogenerated HTML docs for v2.45.1-145-g83f1a
Diffstat (limited to 'RelNotes')
-rw-r--r-- | RelNotes/2.39.4.txt | 79 | ||||
-rw-r--r-- | RelNotes/2.40.2.txt | 7 | ||||
-rw-r--r-- | RelNotes/2.41.1.txt | 7 | ||||
-rw-r--r-- | RelNotes/2.42.2.txt | 7 | ||||
-rw-r--r-- | RelNotes/2.43.4.txt | 7 | ||||
-rw-r--r-- | RelNotes/2.44.1.txt | 8 | ||||
-rw-r--r-- | RelNotes/2.45.1.txt | 8 |
7 files changed, 123 insertions, 0 deletions
diff --git a/RelNotes/2.39.4.txt b/RelNotes/2.39.4.txt new file mode 100644 index 000000000..7f54521fe --- /dev/null +++ b/RelNotes/2.39.4.txt @@ -0,0 +1,79 @@ +Git v2.39.4 Release Notes +========================= + +This addresses the security issues CVE-2024-32002, CVE-2024-32004, +CVE-2024-32020 and CVE-2024-32021. + +This release also backports fixes necessary to let the CI builds pass +successfully. + +Fixes since v2.39.3 +------------------- + + * CVE-2024-32002: + + Recursive clones on case-insensitive filesystems that support symbolic + links are susceptible to case confusion that can be exploited to + execute just-cloned code during the clone operation. + + * CVE-2024-32004: + + Repositories can be configured to execute arbitrary code during local + clones. To address this, the ownership checks introduced in v2.30.3 + are now extended to cover cloning local repositories. + + * CVE-2024-32020: + + Local clones may end up hardlinking files into the target repository's + object database when source and target repository reside on the same + disk. If the source repository is owned by a different user, then + those hardlinked files may be rewritten at any point in time by the + untrusted user. + + * CVE-2024-32021: + + When cloning a local source repository that contains symlinks via the + filesystem, Git may create hardlinks to arbitrary user-readable files + on the same filesystem as the target repository in the objects/ + directory. + + * CVE-2024-32465: + + It is supposed to be safe to clone untrusted repositories, even those + unpacked from zip archives or tarballs originating from untrusted + sources, but Git can be tricked to run arbitrary code as part of the + clone. + + * Defense-in-depth: submodule: require the submodule path to contain + directories only. + + * Defense-in-depth: clone: when symbolic links collide with directories, keep + the latter. + + * Defense-in-depth: clone: prevent hooks from running during a clone. + + * Defense-in-depth: core.hooksPath: add some protection while cloning. + + * Defense-in-depth: fsck: warn about symlink pointing inside a gitdir. + + * Various fix-ups on HTTP tests. + + * Test update. + + * HTTP Header redaction code has been adjusted for a newer version of + cURL library that shows its traces differently from earlier + versions. + + * Fix was added to work around a regression in libcURL 8.7.0 (which has + already been fixed in their tip of the tree). + + * Replace macos-12 used at GitHub CI with macos-13. + + * ci(linux-asan/linux-ubsan): let's save some time + + * Tests with LSan from time to time seem to emit harmless message that makes + our tests unnecessarily flakey; we work it around by filtering the + uninteresting output. + + * Update GitHub Actions jobs to avoid warnings against using deprecated + version of Node.js. diff --git a/RelNotes/2.40.2.txt b/RelNotes/2.40.2.txt new file mode 100644 index 000000000..646a2cc3e --- /dev/null +++ b/RelNotes/2.40.2.txt @@ -0,0 +1,7 @@ +Git v2.40.2 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4 to address +the security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, +CVE-2024-32021 and CVE-2024-32465; see the release notes for that +version for details. diff --git a/RelNotes/2.41.1.txt b/RelNotes/2.41.1.txt new file mode 100644 index 000000000..9fb4c218b --- /dev/null +++ b/RelNotes/2.41.1.txt @@ -0,0 +1,7 @@ +Git v2.41.1 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4 and v2.40.2 +to address the security issues CVE-2024-32002, CVE-2024-32004, +CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; see the release +notes for these versions for details. diff --git a/RelNotes/2.42.2.txt b/RelNotes/2.42.2.txt new file mode 100644 index 000000000..dbf761a01 --- /dev/null +++ b/RelNotes/2.42.2.txt @@ -0,0 +1,7 @@ +Git v2.42.2 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4, v2.40.2 +and v2.41.1 to address the security issues CVE-2024-32002, +CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; +see the release notes for these versions for details. diff --git a/RelNotes/2.43.4.txt b/RelNotes/2.43.4.txt new file mode 100644 index 000000000..0a842515f --- /dev/null +++ b/RelNotes/2.43.4.txt @@ -0,0 +1,7 @@ +Git v2.43.4 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4, v2.40.2, +v2.41.1 and v2.42.2 to address the security issues CVE-2024-32002, +CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; +see the release notes for these versions for details. diff --git a/RelNotes/2.44.1.txt b/RelNotes/2.44.1.txt new file mode 100644 index 000000000..b5135c328 --- /dev/null +++ b/RelNotes/2.44.1.txt @@ -0,0 +1,8 @@ +Git v2.44.1 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4, v2.40.2, +v2.41.1, v2.42.2 and v2.43.4 to address the security issues +CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 +and CVE-2024-32465; see the release notes for these versions +for details. diff --git a/RelNotes/2.45.1.txt b/RelNotes/2.45.1.txt new file mode 100644 index 000000000..3b0d60cfa --- /dev/null +++ b/RelNotes/2.45.1.txt @@ -0,0 +1,8 @@ +Git v2.45.1 Release Notes +========================= + +This release merges up the fix that appears in v2.39.4, +v2.40.2, v2.41.1, v2.42.2, v2.43.4 and v2.44.1 to address the +security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, +CVE-2024-32021 and CVE-2024-32465; see the release notes for +these versions for details. |