| Git v2.17.5 Release Notes |
| ========================= |
| |
| This release is to address a security issue: CVE-2020-11008 |
| |
| Fixes since v2.17.4 |
| ------------------- |
| |
| * With a crafted URL that contains a newline or empty host, or lacks |
| a scheme, the credential helper machinery can be fooled into |
| providing credential information that is not appropriate for the |
| protocol in use and host being contacted. |
| |
| Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the |
| credentials are not for a host of the attacker's choosing; instead, |
| they are for some unspecified host (based on how the configured |
| credential helper handles an absent "host" parameter). |
| |
| The attack has been made impossible by refusing to work with |
| under-specified credential patterns. |
| |
| Credit for finding the vulnerability goes to Carlo Arenas. |
