| Git v2.30.8 Release Notes |
| ========================= |
| |
| This release addresses the security issues CVE-2023-22490 and |
| CVE-2023-23946. |
| |
| |
| Fixes since v2.30.7 |
| ------------------- |
| |
| * CVE-2023-22490: |
| |
| Using a specially-crafted repository, Git can be tricked into using |
| its local clone optimization even when using a non-local transport. |
| Though Git will abort local clones whose source $GIT_DIR/objects |
| directory contains symbolic links (c.f., CVE-2022-39253), the objects |
| directory itself may still be a symbolic link. |
| |
| These two may be combined to include arbitrary files based on known |
| paths on the victim's filesystem within the malicious repository's |
| working copy, allowing for data exfiltration in a similar manner as |
| CVE-2022-39253. |
| |
| * CVE-2023-23946: |
| |
| By feeding a crafted input to "git apply", a path outside the |
| working tree can be overwritten as the user who is running "git |
| apply". |
| |
| * A mismatched type in `attr.c::read_attr_from_index()` which could |
| cause Git to errantly reject attributes on Windows and 32-bit Linux |
| has been corrected. |
| |
| Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was |
| developed by Taylor Blau, with additional help from others on the |
| Git security mailing list. |
| |
| Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the |
| fix was developed by Patrick Steinhardt. |
| |
| |
| Johannes Schindelin (1): |
| attr: adjust a mismatched data type |
| |
| Patrick Steinhardt (1): |
| apply: fix writing behind newly created symbolic links |
| |
| Taylor Blau (3): |
| t5619: demonstrate clone_local() with ambiguous transport |
| clone: delay picking a transport until after get_repo_path() |
| dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS |
