From 5e0649dc65fe33e8cf38823350e9d7951f6a6346 Mon Sep 17 00:00:00 2001 From: Junio C Hamano Date: Sun, 30 Jul 2017 14:45:13 -0700 Subject: [PATCH] Git 2.7.6 Signed-off-by: Junio C Hamano --- Documentation/RelNotes/2.7.6.txt | 25 +++++++++++++++++++++++++ GIT-VERSION-GEN | 2 +- RelNotes | 2 +- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/RelNotes/2.7.6.txt diff --git a/Documentation/RelNotes/2.7.6.txt b/Documentation/RelNotes/2.7.6.txt new file mode 100644 index 0000000000..4c6d1dcd4a --- /dev/null +++ b/Documentation/RelNotes/2.7.6.txt @@ -0,0 +1,25 @@ +Git v2.7.6 Release Notes +======================== + +Fixes since v2.7.5 +------------------ + + * A "ssh://..." URL can result in a "ssh" command line with a + hostname that begins with a dash "-", which would cause the "ssh" + command to instead (mis)treat it as an option. This is now + prevented by forbidding such a hostname (which will not be + necessary in the real world). + + * Similarly, when GIT_PROXY_COMMAND is configured, the command is + run with host and port that are parsed out from "ssh://..." URL; + a poorly written GIT_PROXY_COMMAND could be tricked into treating + a string that begins with a dash "-". This is now prevented by + forbidding such a hostname and port number (again, which will not + be necessary in the real world). + + * In the same spirit, a repository name that begins with a dash "-" + is also forbidden now. + +Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity +Labs and Jeff King at GitHub. + diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN index c80681ef00..2c156bce82 100755 --- a/GIT-VERSION-GEN +++ b/GIT-VERSION-GEN @@ -1,7 +1,7 @@ #!/bin/sh GVF=GIT-VERSION-FILE -DEF_VER=v2.7.5 +DEF_VER=v2.7.6 LF=' ' diff --git a/RelNotes b/RelNotes index 1609b5af0d..a256349b9d 120000 --- a/RelNotes +++ b/RelNotes @@ -1 +1 @@ -Documentation/RelNotes/2.7.5.txt \ No newline at end of file +Documentation/RelNotes/2.7.6.txt \ No newline at end of file -- 2.11.4.GIT