Skip to content

Commit 4084321

Browse files
dschodscho
committed
Sync with 2.35.7
* maint-2.35: Git 2.35.7 Git 2.34.7 http: support CURLOPT_PROTOCOLS_STR http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT Git 2.33.7 Git 2.32.6 Git 2.31.7 Git 2.30.8 apply: fix writing behind newly created symbolic links dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS clone: delay picking a transport until after get_repo_path() t5619: demonstrate clone_local() with ambiguous transport
2 parents 5c1fc48 + b7a92d0 commit 4084321

20 files changed

+404
-53
lines changed

‎Documentation/RelNotes/2.30.8.txt

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
Git v2.30.8 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2023-22490 and
5+
CVE-2023-23946.
6+
7+
8+
Fixes since v2.30.7
9+
-------------------
10+
11+
* CVE-2023-22490:
12+
13+
Using a specially-crafted repository, Git can be tricked into using
14+
its local clone optimization even when using a non-local transport.
15+
Though Git will abort local clones whose source $GIT_DIR/objects
16+
directory contains symbolic links (c.f., CVE-2022-39253), the objects
17+
directory itself may still be a symbolic link.
18+
19+
These two may be combined to include arbitrary files based on known
20+
paths on the victim's filesystem within the malicious repository's
21+
working copy, allowing for data exfiltration in a similar manner as
22+
CVE-2022-39253.
23+
24+
* CVE-2023-23946:
25+
26+
By feeding a crafted input to "git apply", a path outside the
27+
working tree can be overwritten as the user who is running "git
28+
apply".
29+
30+
* A mismatched type in `attr.c::read_attr_from_index()` which could
31+
cause Git to errantly reject attributes on Windows and 32-bit Linux
32+
has been corrected.
33+
34+
Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
35+
developed by Taylor Blau, with additional help from others on the
36+
Git security mailing list.
37+
38+
Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
39+
fix was developed by Patrick Steinhardt.
40+
41+
42+
Johannes Schindelin (1):
43+
attr: adjust a mismatched data type
44+
45+
Patrick Steinhardt (1):
46+
apply: fix writing behind newly created symbolic links
47+
48+
Taylor Blau (3):
49+
t5619: demonstrate clone_local() with ambiguous transport
50+
clone: delay picking a transport until after get_repo_path()
51+
dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
52+

‎Documentation/RelNotes/2.31.7.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.31.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8 to
5+
address the security issues CVE-2023-22490 and CVE-2023-23946;
6+
see the release notes for that version for details.

‎Documentation/RelNotes/2.32.6.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.32.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8 and v2.31.7
5+
to address the security issues CVE-2023-22490 and CVE-2023-23946;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.33.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.33.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7
5+
and v2.32.6 to address the security issues CVE-2023-22490 and
6+
CVE-2023-23946; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.34.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.34.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6 and v2.33.7 to address the security issues CVE-2023-22490
6+
and CVE-2023-23946; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.35.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.35.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6, v2.33.7 and v2.34.7 to address the security issues
6+
CVE-2023-22490 and CVE-2023-23946; see the release notes for
7+
these versions for details.

‎INSTALL

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ Issues of note:
144144
not need that functionality, use NO_CURL to build without
145145
it.
146146

147-
Git requires version "7.19.4" or later of "libcurl" to build
147+
Git requires version "7.19.5" or later of "libcurl" to build
148148
without NO_CURL. This version requirement may be bumped in
149149
the future.
150150

‎apply.c

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4408,6 +4408,33 @@ static int create_one_file(struct apply_state *state,
44084408
if (state->cached)
44094409
return 0;
44104410

4411+
/*
4412+
* We already try to detect whether files are beyond a symlink in our
4413+
* up-front checks. But in the case where symlinks are created by any
4414+
* of the intermediate hunks it can happen that our up-front checks
4415+
* didn't yet see the symlink, but at the point of arriving here there
4416+
* in fact is one. We thus repeat the check for symlinks here.
4417+
*
4418+
* Note that this does not make the up-front check obsolete as the
4419+
* failure mode is different:
4420+
*
4421+
* - The up-front checks cause us to abort before we have written
4422+
* anything into the working directory. So when we exit this way the
4423+
* working directory remains clean.
4424+
*
4425+
* - The checks here happen in the middle of the action where we have
4426+
* already started to apply the patch. The end result will be a dirty
4427+
* working directory.
4428+
*
4429+
* Ideally, we should update the up-front checks to catch what would
4430+
* happen when we apply the patch before we damage the working tree.
4431+
* We have all the information necessary to do so. But for now, as a
4432+
* part of embargoed security work, having this check would serve as a
4433+
* reasonable first step.
4434+
*/
4435+
if (path_is_beyond_symlink(state, path))
4436+
return error(_("affected file '%s' is beyond a symbolic link"), path);
4437+
44114438
res = try_create_file(state, path, mode, buf, size);
44124439
if (res < 0)
44134440
return -1;

‎builtin/clone.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1150,10 +1150,6 @@ int cmd_clone(int argc, const char **argv, const char *prefix)
11501150
refspec_appendf(&remote->fetch, "+%s*:%s*", src_ref_prefix,
11511151
branch_top.buf);
11521152

1153-
transport = transport_get(remote, remote->url[0]);
1154-
transport_set_verbosity(transport, option_verbosity, option_progress);
1155-
transport->family = family;
1156-
11571153
path = get_repo_path(remote->url[0], &is_bundle);
11581154
is_local = option_local != 0 && path && !is_bundle;
11591155
if (is_local) {
@@ -1175,6 +1171,10 @@ int cmd_clone(int argc, const char **argv, const char *prefix)
11751171
}
11761172
if (option_local > 0 && !is_local)
11771173
warning(_("--local is ignored"));
1174+
1175+
transport = transport_get(remote, path ? path : remote->url[0]);
1176+
transport_set_verbosity(transport, option_verbosity, option_progress);
1177+
transport->family = family;
11781178
transport->cloning = 1;
11791179

11801180
if (is_bundle) {

‎dir-iterator.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ struct dir_iterator *dir_iterator_begin(const char *path, unsigned int flags)
203203
{
204204
struct dir_iterator_int *iter = xcalloc(1, sizeof(*iter));
205205
struct dir_iterator *dir_iterator = &iter->base;
206-
int saved_errno;
206+
int saved_errno, err;
207207

208208
strbuf_init(&iter->base.path, PATH_MAX);
209209
strbuf_addstr(&iter->base.path, path);
@@ -213,10 +213,15 @@ struct dir_iterator *dir_iterator_begin(const char *path, unsigned int flags)
213213
iter->flags = flags;
214214

215215
/*
216-
* Note: stat already checks for NULL or empty strings and
217-
* inexistent paths.
216+
* Note: stat/lstat already checks for NULL or empty strings and
217+
* nonexistent paths.
218218
*/
219-
if (stat(iter->base.path.buf, &iter->base.st) < 0) {
219+
if (iter->flags & DIR_ITERATOR_FOLLOW_SYMLINKS)
220+
err = stat(iter->base.path.buf, &iter->base.st);
221+
else
222+
err = lstat(iter->base.path.buf, &iter->base.st);
223+
224+
if (err < 0) {
220225
saved_errno = errno;
221226
goto error_out;
222227
}

0 commit comments

Comments
 (0)