| blob | 38c23e0345551c8c0c6145441ac912ef3a1118f7 |
1 Git v2.30.8 Release Notes
2 =========================
4 This release addresses the security issues CVE-2023-22490 and
5 CVE-2023-23946.
8 Fixes since v2.30.7
9 -------------------
11 * CVE-2023-22490:
13 Using a specially-crafted repository, Git can be tricked into using
14 its local clone optimization even when using a non-local transport.
15 Though Git will abort local clones whose source $GIT_DIR/objects
16 directory contains symbolic links (c.f., CVE-2022-39253), the objects
17 directory itself may still be a symbolic link.
19 These two may be combined to include arbitrary files based on known
20 paths on the victim's filesystem within the malicious repository's
21 working copy, allowing for data exfiltration in a similar manner as
22 CVE-2022-39253.
24 * CVE-2023-23946:
26 By feeding a crafted input to "git apply", a path outside the
27 working tree can be overwritten as the user who is running "git
28 apply".
30 * A mismatched type in `attr.c::read_attr_from_index()` which could
31 cause Git to errantly reject attributes on Windows and 32-bit Linux
32 has been corrected.
34 Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
35 developed by Taylor Blau, with additional help from others on the
36 Git security mailing list.
38 Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
39 fix was developed by Patrick Steinhardt.
42 Johannes Schindelin (1):
43 attr: adjust a mismatched data type
45 Patrick Steinhardt (1):
46 apply: fix writing behind newly created symbolic links
48 Taylor Blau (3):
49 t5619: demonstrate clone_local() with ambiguous transport
50 clone: delay picking a transport until after get_repo_path()
51 dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS