Skip to content

Commit 6487e9c

Browse files
dschodscho
committed
Sync with 2.37.6
* maint-2.37: Git 2.37.6 Git 2.36.5 Git 2.35.7 Git 2.34.7 http: support CURLOPT_PROTOCOLS_STR http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT Git 2.33.7 Git 2.32.6 Git 2.31.7 Git 2.30.8 apply: fix writing behind newly created symbolic links dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS clone: delay picking a transport until after get_repo_path() t5619: demonstrate clone_local() with ambiguous transport
2 parents b78628d + eb88fe1 commit 6487e9c

22 files changed

+418
-53
lines changed

‎Documentation/RelNotes/2.30.8.txt

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
Git v2.30.8 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2023-22490 and
5+
CVE-2023-23946.
6+
7+
8+
Fixes since v2.30.7
9+
-------------------
10+
11+
* CVE-2023-22490:
12+
13+
Using a specially-crafted repository, Git can be tricked into using
14+
its local clone optimization even when using a non-local transport.
15+
Though Git will abort local clones whose source $GIT_DIR/objects
16+
directory contains symbolic links (c.f., CVE-2022-39253), the objects
17+
directory itself may still be a symbolic link.
18+
19+
These two may be combined to include arbitrary files based on known
20+
paths on the victim's filesystem within the malicious repository's
21+
working copy, allowing for data exfiltration in a similar manner as
22+
CVE-2022-39253.
23+
24+
* CVE-2023-23946:
25+
26+
By feeding a crafted input to "git apply", a path outside the
27+
working tree can be overwritten as the user who is running "git
28+
apply".
29+
30+
* A mismatched type in `attr.c::read_attr_from_index()` which could
31+
cause Git to errantly reject attributes on Windows and 32-bit Linux
32+
has been corrected.
33+
34+
Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
35+
developed by Taylor Blau, with additional help from others on the
36+
Git security mailing list.
37+
38+
Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
39+
fix was developed by Patrick Steinhardt.
40+
41+
42+
Johannes Schindelin (1):
43+
attr: adjust a mismatched data type
44+
45+
Patrick Steinhardt (1):
46+
apply: fix writing behind newly created symbolic links
47+
48+
Taylor Blau (3):
49+
t5619: demonstrate clone_local() with ambiguous transport
50+
clone: delay picking a transport until after get_repo_path()
51+
dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
52+

‎Documentation/RelNotes/2.31.7.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.31.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8 to
5+
address the security issues CVE-2023-22490 and CVE-2023-23946;
6+
see the release notes for that version for details.

‎Documentation/RelNotes/2.32.6.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.32.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8 and v2.31.7
5+
to address the security issues CVE-2023-22490 and CVE-2023-23946;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.33.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.33.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7
5+
and v2.32.6 to address the security issues CVE-2023-22490 and
6+
CVE-2023-23946; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.34.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.34.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6 and v2.33.7 to address the security issues CVE-2023-22490
6+
and CVE-2023-23946; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.35.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.35.7 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6, v2.33.7 and v2.34.7 to address the security issues
6+
CVE-2023-22490 and CVE-2023-23946; see the release notes for
7+
these versions for details.

‎Documentation/RelNotes/2.36.5.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.36.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6, v2.33.7, v2.34.7 and v2.35.7 to address the security
6+
issues CVE-2023-22490 and CVE-2023-23946; see the release notes
7+
for these versions for details.

‎Documentation/RelNotes/2.37.6.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.37.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.30.8, v2.31.7,
5+
v2.32.6, v2.33.7, v2.34.7, v2.35.7 and v2.36.5 to address the
6+
security issues CVE-2023-22490 and CVE-2023-23946; see the release
7+
notes for these versions for details.

‎INSTALL

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ Issues of note:
143143
not need that functionality, use NO_CURL to build without
144144
it.
145145

146-
Git requires version "7.19.4" or later of "libcurl" to build
146+
Git requires version "7.19.5" or later of "libcurl" to build
147147
without NO_CURL. This version requirement may be bumped in
148148
the future.
149149

‎apply.c

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4408,6 +4408,33 @@ static int create_one_file(struct apply_state *state,
44084408
if (state->cached)
44094409
return 0;
44104410

4411+
/*
4412+
* We already try to detect whether files are beyond a symlink in our
4413+
* up-front checks. But in the case where symlinks are created by any
4414+
* of the intermediate hunks it can happen that our up-front checks
4415+
* didn't yet see the symlink, but at the point of arriving here there
4416+
* in fact is one. We thus repeat the check for symlinks here.
4417+
*
4418+
* Note that this does not make the up-front check obsolete as the
4419+
* failure mode is different:
4420+
*
4421+
* - The up-front checks cause us to abort before we have written
4422+
* anything into the working directory. So when we exit this way the
4423+
* working directory remains clean.
4424+
*
4425+
* - The checks here happen in the middle of the action where we have
4426+
* already started to apply the patch. The end result will be a dirty
4427+
* working directory.
4428+
*
4429+
* Ideally, we should update the up-front checks to catch what would
4430+
* happen when we apply the patch before we damage the working tree.
4431+
* We have all the information necessary to do so. But for now, as a
4432+
* part of embargoed security work, having this check would serve as a
4433+
* reasonable first step.
4434+
*/
4435+
if (path_is_beyond_symlink(state, path))
4436+
return error(_("affected file '%s' is beyond a symbolic link"), path);
4437+
44114438
res = try_create_file(state, path, mode, buf, size);
44124439
if (res < 0)
44134440
return -1;

0 commit comments

Comments
 (0)