Skip to content

Commit 83f1add

Browse files
gitstergitster
committed
Sync with Git 2.45.1
* tag 'v2.45.1': (42 commits) Git 2.45.1 Git 2.44.1 Git 2.43.4 Git 2.42.2 Git 2.41.1 Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks ...
2 parents 3e4a232 + 2c7b491 commit 83f1add

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1283
-86
lines changed

‎Documentation/RelNotes/2.39.4.txt

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
Git v2.39.4 Release Notes
2+
=========================
3+
4+
This addresses the security issues CVE-2024-32002, CVE-2024-32004,
5+
CVE-2024-32020 and CVE-2024-32021.
6+
7+
This release also backports fixes necessary to let the CI builds pass
8+
successfully.
9+
10+
Fixes since v2.39.3
11+
-------------------
12+
13+
* CVE-2024-32002:
14+
15+
Recursive clones on case-insensitive filesystems that support symbolic
16+
links are susceptible to case confusion that can be exploited to
17+
execute just-cloned code during the clone operation.
18+
19+
* CVE-2024-32004:
20+
21+
Repositories can be configured to execute arbitrary code during local
22+
clones. To address this, the ownership checks introduced in v2.30.3
23+
are now extended to cover cloning local repositories.
24+
25+
* CVE-2024-32020:
26+
27+
Local clones may end up hardlinking files into the target repository's
28+
object database when source and target repository reside on the same
29+
disk. If the source repository is owned by a different user, then
30+
those hardlinked files may be rewritten at any point in time by the
31+
untrusted user.
32+
33+
* CVE-2024-32021:
34+
35+
When cloning a local source repository that contains symlinks via the
36+
filesystem, Git may create hardlinks to arbitrary user-readable files
37+
on the same filesystem as the target repository in the objects/
38+
directory.
39+
40+
* CVE-2024-32465:
41+
42+
It is supposed to be safe to clone untrusted repositories, even those
43+
unpacked from zip archives or tarballs originating from untrusted
44+
sources, but Git can be tricked to run arbitrary code as part of the
45+
clone.
46+
47+
* Defense-in-depth: submodule: require the submodule path to contain
48+
directories only.
49+
50+
* Defense-in-depth: clone: when symbolic links collide with directories, keep
51+
the latter.
52+
53+
* Defense-in-depth: clone: prevent hooks from running during a clone.
54+
55+
* Defense-in-depth: core.hooksPath: add some protection while cloning.
56+
57+
* Defense-in-depth: fsck: warn about symlink pointing inside a gitdir.
58+
59+
* Various fix-ups on HTTP tests.
60+
61+
* Test update.
62+
63+
* HTTP Header redaction code has been adjusted for a newer version of
64+
cURL library that shows its traces differently from earlier
65+
versions.
66+
67+
* Fix was added to work around a regression in libcURL 8.7.0 (which has
68+
already been fixed in their tip of the tree).
69+
70+
* Replace macos-12 used at GitHub CI with macos-13.
71+
72+
* ci(linux-asan/linux-ubsan): let's save some time
73+
74+
* Tests with LSan from time to time seem to emit harmless message that makes
75+
our tests unnecessarily flakey; we work it around by filtering the
76+
uninteresting output.
77+
78+
* Update GitHub Actions jobs to avoid warnings against using deprecated
79+
version of Node.js.

‎Documentation/RelNotes/2.40.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.40.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 to address
5+
the security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
6+
CVE-2024-32021 and CVE-2024-32465; see the release notes for that
7+
version for details.

‎Documentation/RelNotes/2.41.1.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.41.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 and v2.40.2
5+
to address the security issues CVE-2024-32002, CVE-2024-32004,
6+
CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; see the release
7+
notes for these versions for details.

‎Documentation/RelNotes/2.42.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.42.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2
5+
and v2.41.1 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.43.4.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1 and v2.42.2 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.44.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.44.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1, v2.42.2 and v2.43.4 to address the security issues
6+
CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021
7+
and CVE-2024-32465; see the release notes for these versions
8+
for details.

‎Documentation/RelNotes/2.45.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.45.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4,
5+
v2.40.2, v2.41.1, v2.42.2, v2.43.4 and v2.44.1 to address the
6+
security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
7+
CVE-2024-32021 and CVE-2024-32465; see the release notes for
8+
these versions for details.

‎Documentation/fsck-msgids.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,18 @@
164164
`nullSha1`::
165165
(WARN) Tree contains entries pointing to a null sha1.
166166

167+
`symlinkPointsToGitDir`::
168+
(WARN) Symbolic link points inside a gitdir.
169+
170+
`symlinkTargetBlob`::
171+
(ERROR) A non-blob found instead of a symbolic link's target.
172+
173+
`symlinkTargetLength`::
174+
(WARN) Symbolic link target longer than maximum path length.
175+
176+
`symlinkTargetMissing`::
177+
(ERROR) Unable to read symbolic link target's blob.
178+
167179
`treeNotSorted`::
168180
(ERROR) A tree is not properly sorted.
169181

‎Documentation/git-upload-pack.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,37 @@ ENVIRONMENT
5555
admins may need to configure some transports to allow this
5656
variable to be passed. See the discussion in linkgit:git[1].
5757

58+
`GIT_NO_LAZY_FETCH`::
59+
When cloning or fetching from a partial repository (i.e., one
60+
itself cloned with `--filter`), the server-side `upload-pack`
61+
may need to fetch extra objects from its upstream in order to
62+
complete the request. By default, `upload-pack` will refuse to
63+
perform such a lazy fetch, because `git fetch` may run arbitrary
64+
commands specified in configuration and hooks of the source
65+
repository (and `upload-pack` tries to be safe to run even in
66+
untrusted `.git` directories).
67+
+
68+
This is implemented by having `upload-pack` internally set the
69+
`GIT_NO_LAZY_FETCH` variable to `1`. If you want to override it
70+
(because you are fetching from a partial clone, and you are sure
71+
you trust it), you can explicitly set `GIT_NO_LAZY_FETCH` to
72+
`0`.
73+
74+
SECURITY
75+
--------
76+
77+
Most Git commands should not be run in an untrusted `.git` directory
78+
(see the section `SECURITY` in linkgit:git[1]). `upload-pack` tries to
79+
avoid any dangerous configuration options or hooks from the repository
80+
it's serving, making it safe to clone an untrusted directory and run
81+
commands on the resulting clone.
82+
83+
For an extra level of safety, you may be able to run `upload-pack` as an
84+
alternate user. The details will be platform dependent, but on many
85+
systems you can run:
86+
87+
git clone --no-local --upload-pack='sudo -u nobody git-upload-pack' ...
88+
5889
SEE ALSO
5990
--------
6091
linkgit:gitnamespaces[7]

‎Documentation/git.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,37 @@ The index is also capable of storing multiple entries (called "stages")
10671067
for a given pathname. These stages are used to hold the various
10681068
unmerged version of a file when a merge is in progress.
10691069

1070+
SECURITY
1071+
--------
1072+
1073+
Some configuration options and hook files may cause Git to run arbitrary
1074+
shell commands. Because configuration and hooks are not copied using
1075+
`git clone`, it is generally safe to clone remote repositories with
1076+
untrusted content, inspect them with `git log`, and so on.
1077+
1078+
However, it is not safe to run Git commands in a `.git` directory (or
1079+
the working tree that surrounds it) when that `.git` directory itself
1080+
comes from an untrusted source. The commands in its config and hooks
1081+
are executed in the usual way.
1082+
1083+
By default, Git will refuse to run when the repository is owned by
1084+
someone other than the user running the command. See the entry for
1085+
`safe.directory` in linkgit:git-config[1]. While this can help protect
1086+
you in a multi-user environment, note that you can also acquire
1087+
untrusted repositories that are owned by you (for example, if you
1088+
extract a zip file or tarball from an untrusted source). In such cases,
1089+
you'd need to "sanitize" the untrusted repository first.
1090+
1091+
If you have an untrusted `.git` directory, you should first clone it
1092+
with `git clone --no-local` to obtain a clean copy. Git does restrict
1093+
the set of options and hooks that will be run by `upload-pack`, which
1094+
handles the server side of a clone or fetch, but beware that the
1095+
surface area for attack against `upload-pack` is large, so this does
1096+
carry some risk. The safest thing is to serve the repository as an
1097+
unprivileged user (either via linkgit:git-daemon[1], ssh, or using
1098+
other tools to change user ids). See the discussion in the `SECURITY`
1099+
section of linkgit:git-upload-pack[1].
1100+
10701101
FURTHER DOCUMENTATION
10711102
---------------------
10721103

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy