Skip to content

Commit 7034cd0

Browse files
gitstergitster
committed
Sync with Git 2.24.1
2 parents 559c6fc + 53a06cf commit 7034cd0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+991
-87
lines changed

‎Documentation/RelNotes/2.14.6.txt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Git v2.14.6 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2019-1348,
5+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
6+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387.
7+
8+
Fixes since v2.14.5
9+
-------------------
10+
11+
* CVE-2019-1348:
12+
The --export-marks option of git fast-import is exposed also via
13+
the in-stream command feature export-marks=... and it allows
14+
overwriting arbitrary paths.
15+
16+
* CVE-2019-1349:
17+
When submodules are cloned recursively, under certain circumstances
18+
Git could be fooled into using the same Git directory twice. We now
19+
require the directory to be empty.
20+
21+
* CVE-2019-1350:
22+
Incorrect quoting of command-line arguments allowed remote code
23+
execution during a recursive clone in conjunction with SSH URLs.
24+
25+
* CVE-2019-1351:
26+
While the only permitted drive letters for physical drives on
27+
Windows are letters of the US-English alphabet, this restriction
28+
does not apply to virtual drives assigned via subst <letter>:
29+
<path>. Git mistook such paths for relative paths, allowing writing
30+
outside of the worktree while cloning.
31+
32+
* CVE-2019-1352:
33+
Git was unaware of NTFS Alternate Data Streams, allowing files
34+
inside the .git/ directory to be overwritten during a clone.
35+
36+
* CVE-2019-1353:
37+
When running Git in the Windows Subsystem for Linux (also known as
38+
"WSL") while accessing a working directory on a regular Windows
39+
drive, none of the NTFS protections were active.
40+
41+
* CVE-2019-1354:
42+
Filenames on Linux/Unix can contain backslashes. On Windows,
43+
backslashes are directory separators. Git did not use to refuse to
44+
write out tracked files with such filenames.
45+
46+
* CVE-2019-1387:
47+
Recursive clones are currently affected by a vulnerability that is
48+
caused by too-lax validation of submodule names, allowing very
49+
targeted attacks via remote code execution in recursive clones.
50+
51+
Credit for finding these vulnerabilities goes to Microsoft Security
52+
Response Center, in particular to Nicolas Joly. The `fast-import`
53+
fixes were provided by Jeff King, the other fixes by Johannes
54+
Schindelin with help from Garima Singh.

‎Documentation/RelNotes/2.15.4.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Git v2.15.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 to address
5+
the security issues CVE-2019-1348, CVE-2019-1349, CVE-2019-1350,
6+
CVE-2019-1351, CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, and
7+
CVE-2019-1387; see the release notes for that version for details.
8+
9+
In conjunction with a vulnerability that was fixed in v2.20.2,
10+
`.gitmodules` is no longer allowed to contain entries of the form
11+
`submodule.<name>.update=!command`.

‎Documentation/RelNotes/2.16.6.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.16.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.

‎Documentation/RelNotes/2.17.3.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.17.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.
9+
10+
In addition, `git fsck` was taught to identify `.gitmodules` entries
11+
of the form `submodule.<name>.update=!command`, which have been
12+
disallowed in v2.15.4.

‎Documentation/RelNotes/2.18.2.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.18.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.

‎Documentation/RelNotes/2.19.3.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.19.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.

‎Documentation/RelNotes/2.20.2.txt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Git v2.20.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.
9+
10+
The change to disallow `submodule.<name>.update=!command` entries in
11+
`.gitmodules` which was introduced v2.15.4 (and for which v2.17.3
12+
added explicit fsck checks) fixes the vulnerability in v2.20.x where a
13+
recursive clone followed by a submodule update could execute code
14+
contained within the repository without the user explicitly having
15+
asked for that (CVE-2019-19604).
16+
17+
Credit for finding this vulnerability goes to Joern Schneeweisz,
18+
credit for the fixes goes to Jonathan Nieder.

‎Documentation/RelNotes/2.21.1.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.21.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3 and in v2.20.2, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and CVE-2019-19604;
8+
see the release notes for those versions for details.
9+
10+
Additionally, this version also includes a couple of fixes for the
11+
Windows-specific quoting of command-line arguments when Git executes
12+
a Unix shell on Windows.

‎Documentation/RelNotes/2.22.2.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.22.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3, v2.20.2 and in v2.21.1, addressing the security issues
6+
CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
7+
CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and
8+
CVE-2019-19604; see the release notes for those versions for details.

‎Documentation/RelNotes/2.23.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.23.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3, v2.20.2 and in v2.21.1, addressing the security issues
6+
CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
7+
CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and
8+
CVE-2019-19604; see the release notes for those versions for details.

0 commit comments

Comments
 (0)