-
git (1:2.17.1-1ubuntu0.18) bionic-security; urgency=medium
* SECURITY UPDATE: Overwriting path
- debian/patches/CVE-2023_25652_25815_29007/0022-*.patch: apply
--reject overwriting existing .rej symlink if it exists in apply.c,
t/t4115-apply-symlink.sh.
- CVE-2023-25652
* SECURITY UPDATE: Malicious placement of crafted messages
- debian/patches/CVE-2023_25652_25815_29007/0024-*patch:
avoid using gettext if the locale dir is not present in
gettext.c.
- CVE-2023-25815
* SECURITY UPDATE: Arbitrary configuration injection
- debian/patches/CVE-2023_25652_25815_29007/0025-*.patch: avoid
fixed-sized buffer when renaming/deleting a section in config.c.
- debian/patches/CVE-2023_25652_25815_29007/0026-*.patch: avoid
integer truncation in copy_or_rename_section_in_file() in config.c.
- debian/patches/CVE-2023_25652_25815_29007/0027-*.patch: disallow
overly-long lines in copy_or_rename_section_in_file in config.c.
- CVE-2023-29007
-- Leonidas Da Silva Barbosa <email address hidden> Wed, 26 Apr 2023 11:14:45 -0300
-
git (1:2.17.1-1ubuntu0.17) bionic-security; urgency=medium
* SECURITY REGRESSION: Adding missing parts of CVE-2023-22490
local repository clone when .git/objects is a symlink
- debian/patches/CVE_2023_22490_and_23946/0001-dir-iterator-refactor*.patch
- debian/patches/CVE_2023_22490_and_23946/0005-dir-iterator-add-flags*.patch
(LP: #2008277).
-- Leonidas Da Silva Barbosa <email address hidden> Mon, 27 Feb 2023 11:27:06 -0300
-
git (1:2.17.1-1ubuntu0.16) bionic-security; urgency=medium
* SECURITY UPDATE: Overwritten path and using
local clone optimization even when using a non-local transport
- debian/patches/CVE_2023-22490_and_23946/0002-*.patch: adjust
a mismatch data type in attr.c.
- debian/patches/CVE_2023-22490_and_23946/0003-*.patch: demonstrate
clone_local() with ambiguous transport in
t/t5619-clone-local-ambiguous-transport.sh.
- debian/patches/CVE_2023-22490_and_23946/0004-*.patch: delay
picking a transport until after get_repo_path() in builtin/clone.c.
- debian/patches/CVE_2023-22490_and_23946/0006-*.patch: fix writing behind
newly created symbolic links in apply.c, t/t4115-apply-symlink.sh.
- CVE-2023-22490
- CVE-2023-23946
-- Leonidas Da Silva Barbosa <email address hidden> Wed, 08 Feb 2023 12:09:34 -0300
-
git (1:2.17.1-1ubuntu0.15) bionic-security; urgency=medium
* SECURITY REGRESSION: Previous update was incomplete what could causes regressions
- debian/patches/CVE_2022_23521_and_41903/0012-*.patch: update patch with
missed parts (LP: #2003246).
-- Leonidas Da Silva Barbosa <email address hidden> Thu, 19 Jan 2023 08:37:09 -0300
-
git (1:2.17.1-1ubuntu0.14) bionic-security; urgency=medium
* SECURITY UPDATE: Integer overflow
- debian/patches/CVE_2022_23521_and_41903/00*.patch:
attr.c, attr.h, pretty.c, column.c, utf8.c, utf8.h,
t/t4205-log-pretty-formats.sh, t/test-lib.sh, git-compat-util.h,
t/t0003-attributes.sh.
- CVE-2022-23521
- CVE-2022-41903
-- Leonidas Da Silva Barbosa <email address hidden> Thu, 12 Jan 2023 11:48:11 -0300
-
git (1:2.17.1-1ubuntu0.13) bionic-security; urgency=medium
* SECURITY UPDATE: Unexpected behavior
- debian/patches/CVE-2022-39253-*.patch: disallow --local
clones with symlinks and additionally changed the
protocol.file.allow to be user by default in
builtin/clone.c, transport.c, and modified tests in
t/t5604-clone-reference.sh,
lib-submodule-update.sh, t/t1091-sparse-checkout-builtin.sh,
t/t1500-rev-parse.sh, t/t2400-worktree-add.sh,
t/t2403-worktree-move.sh, t/t2405-worktree-submodule.sh,
t/t3200-branch.sh, t/t3420-rebase-autostash.sh,
t/t3426-rebase-submodule.sh, t/t3512-cherry-pick-submodule.sh,
t/t3600-rm.sh, t/t3906-stash-submodule.sh,
t/t4059-diff-submodule-not-initialized.sh,
t/t4060-diff-submodule-option-diff-format.sh,
t/t4067-diff-partial-clone.sh,
t/t4208-log-magic-pathspec.sh, t/t5510-fetch.sh,
t/t5526-fetch-submodules.sh, t/t5545-push-options.sh,
t/t5572-pull-submodule.sh, t/t5601-clone.sh,
t/t5614-clone-submodules-shallow.sh, t/t5616-partial-clone.sh,
t/t5617-clone-submodules-remote.sh, t/t6008-rev-list-submodule.sh,
t/t6134-pathspec-in-submodule.sh,
t/t7001-mv.sh, t/t7064-wtstatus-pv2.sh,
t/t7300-clean.sh, t/t7400-submodule-basic.sh,
t/t7403-submodule-sync.sh, t/t7406-submodule-update.sh,
t/t7407-submodule-foreach.sh, t/t7408-submodule-reference.sh,
t/t7409-submodule-detached-work-tree.sh, t/t7411-submodule-config.sh,
t/t7413-submodule-is-active.sh, t/t7414-submodule-mistakes.sh,
t/t7415-submodule-names.sh, t/t7416-submodule-dash-url.sh,
t/t7417-submodule-path-url.sh, t/t7418-submodule-sparse-gitmodules.sh,
t/t7419-submodule-set-branch.sh, t/t7420-submodule-set-url.sh,
t/t7421-submodule-summary-add.sh, t/t7506-status-submodule.sh,
t/t7507-commit-verbose.sh, t/t7800-difftool.sh,
t/t7814-grep-recurse-submodules.sh, t/t9304-fast-import-marks.sh,
t/t9350-fast-export.sh, t/t1092-sparse-checkout-compatibility.sh,
t/t2080-parallel-checkout-basics.sh, t/t7450-bad-git-dotfiles.sh.
- CVE-2022-39253
* SECURITY UPDATE: Arbitrary heap writes
- debian/patches/CVE-2022-39260-*.patch: limit size of interactive
commands and reject too-long cmdline strings in split cmdline()
in shell.c, t/t9850-shell.sh, alias.c.
- CVE-2022-39260
-- Leonidas Da Silva Barbosa <email address hidden> Fri, 14 Oct 2022 11:15:33 -0300
-
git (1:2.17.1-1ubuntu0.12) bionic-security; urgency=medium
* SECURITY UPDATE: Potential arbitrary code execution
- debian/patches/CVE-2022-29187-1.patch: adds test to
regression git needs safe.directory when using sudo in
t/t0034-root-safe-directory.sh.
- debian/patches/CVE-2022-29187-2.patch: avoid failing dir ownership
checks if running privileged in git-compat-util.h,
t/t0034-root-safe-directory.sh.
- debian/patches/CVE-2022-29187-3.patch: add negative tests
and allow git init to mostly work under sudo in
t/lib-sudo.sh b/t/lib-sudo.sh.
- debian/patches/CVE-2022-29187-4.patch: allow root
to access both SUDO_UID and root owned in git-compat-util.h,
t/t0034-root-safe-directory.sh.
- debian/patches/CVE-2022-29187-5.patch: add tests for safe.directory
in t/t0033-safe-directory.sh, setup.c.
- debian/patches/CVE-2022-29187-6.patch: tighten ownership checks
post CVE-2022-24765 in setup.c.
- CVE-2022-29187
-- Leonidas Da Silva Barbosa <email address hidden> Tue, 05 Jul 2022 12:47:55 -0300
-
git (1:2.17.1-1ubuntu0.11) bionic-security; urgency=medium
* SECURITY REGRESSION: Previous update was incomplete causing regressions
and not correctly fixing the issue.
- debian/patches/CVE-2022-24765-5.patch: fix safe.directory
key not being checked in setup.c.
- debian/patches/CVE-2022-24765-6.patch:
opt-out of check with safe.directory=* in setup.c. (LP: #1970260)
-- Leonidas Da Silva Barbosa <email address hidden> Mon, 25 Apr 2022 20:28:52 -0300
-
git (1:2.17.1-1ubuntu0.10) bionic-security; urgency=medium
* SECURITY UPDATE: Run commands in diff users
- debian/patches/CVE-2022-24765-*.patch: fix GIT_CEILING_DIRECTORIES; add
an owner check for the top-level-directory; add a function to
determine whether a path is owned by the current user in patch.c,
t/t0060-path-utils.sh, setup.c, compat/mingw.c, compat/mingw.h,
git-compat-util.hi, config.c, config.h.
- CVE-2022-24765
-- Leonidas Da Silva Barbosa <email address hidden> Fri, 08 Apr 2022 10:49:20 -0300
-
git (1:2.17.1-1ubuntu0.9) bionic-security; urgency=medium
* SECURITY UPDATE: cross-protocol request via newline character in repo path
- debian/patches/CVE-2021-40330.patch: forbid newline in git:// hosts and
repo paths
- CVE-2021-40330
-- Spyros Seimenis <email address hidden> Thu, 09 Sep 2021 18:03:10 +0300
-
git (1:2.17.1-1ubuntu0.8) bionic-security; urgency=medium
* SECURITY UPDATE: remote code exec during clone on case-insensitive FS
- debian/patches/CVE-2021-21300.patch: fix bug that makes checkout
follow symlinks in leading path in cache.h, compat/mingw.c,
git-compat-util.h, run-command.c, symlinks.c, t/t0021-conversion.sh,
t/t0021/rot13-filter.pl, t/t2006-checkout-index-basic.sh,
unpack-trees.c.
- CVE-2021-21300
-- Marc Deslauriers <email address hidden> Thu, 04 Mar 2021 08:02:54 -0500
-
git (1:2.17.1-1ubuntu0.7) bionic-security; urgency=medium
* SECURITY UPDATE: credential helper issue with missing host or scheme
- debian/patches/CVE-2020-11008-1.patch: make "quit" helper more
realistic in t/t0300-credentials.sh.
- debian/patches/CVE-2020-11008-2.patch: use more realistic inputs in
t/t0300-credentials.sh.
- debian/patches/CVE-2020-11008-3.patch: parse URL without host as
empty host, not unset in credential.c, http.c,
t/t0300-credentials.sh.
- debian/patches/CVE-2020-11008-4.patch: refuse to operate when missing
host or protocol in credential.c, t/t0300-credentials.sh.
- debian/patches/CVE-2020-11008-5.patch: convert gitmodules url to URL
passed to curl in fsck.c, t/t7416-submodule-dash-url.sh.
- debian/patches/CVE-2020-11008-6.patch: die() when parsing invalid
urls in credential.c, t/t0300-credentials.sh.
- debian/patches/CVE-2020-11008-7.patch: treat URL without scheme as
invalid in credential.c, fsck.c, t/t5550-http-fetch-dumb.sh,
t/t7416-submodule-dash-url.sh.
- debian/patches/CVE-2020-11008-8.patch: treat URL with empty scheme as
invalid in credential.c, t/t5550-http-fetch-dumb.sh,
t/t7416-submodule-dash-url.sh.
- debian/patches/CVE-2020-11008-9.patch: reject URL with empty host in
.gitmodules in fsck.c, t/t7416-submodule-dash-url.sh.
- CVE-2020-11008
-- Marc Deslauriers <email address hidden> Mon, 20 Apr 2020 12:20:37 -0400
-
git (1:2.17.1-1ubuntu0.6) bionic-security; urgency=medium
* SECURITY UPDATE: credential helper issue with newlines in URL
- debian/patches/CVE-2020-5260-1.patch: avoid writing values with
newlines in credential.c, t/t0300-credentials.sh.
- debian/patches/CVE-2020-5260-2.patch: use test_i18ncmp to check
stderr in t/lib-credential.sh.
- debian/patches/CVE-2020-5260-3.patch: detect unrepresentable values
when parsing urls in credential.c, credential.h,
t/t0300-credentials.sh.
- debian/patches/CVE-2020-5260-4.patch: detect gitmodules URLs with
embedded newlines in fsck.c, t/t7416-submodule-dash-url.sh.
- CVE-2020-5260
-- Marc Deslauriers <email address hidden> Fri, 10 Apr 2020 11:59:06 -0400
-
git (1:2.17.1-1ubuntu0.5) bionic-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2019-13xx/*.patch: upstream patches to fix issues.
- CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387,
CVE-2019-19604
-- Marc Deslauriers <email address hidden> Mon, 09 Dec 2019 08:29:20 -0500
-
git (1:2.17.1-1ubuntu0.4) bionic-security; urgency=medium
* SECURITY UPDATE: Unsafe command execution
- debian/patches/CVE-2018-19486.patch: fix in
run-command.c, t/t0061-run-command.sh.
- CVE-2018-19486
-- <email address hidden> (Leonidas S. Barbosa) Mon, 26 Nov 2018 11:20:24 -0300
-
git (1:2.17.1-1ubuntu0.3) bionic-security; urgency=medium
* SECURITY UPDATE: arbitrary code execution via submodule URLs and
paths in .gitsubmodules.
- 0001-submodule-helper-use-to-signal-end-of-clone-options.patch,
0002-submodule-config-ban-submodule-urls-that-start-with-.patch,
0003-submodule-config-ban-submodule-paths-that-start-with.patch:
disallow urls and files that begin with '--'.
- 0004-fsck-detect-submodule-urls-starting-with-dash.patch,
0005-fsck-detect-submodule-paths-starting-with-dash.patch:
reject gitmodules that contain submdule urls and files that begin
with '--'.
- CVE-2018-17456
git (1:2.17.1-1ubuntu0.2) bionic; urgency=medium
* Build diff-highlight in the contrib dir (closes: #868871, LP: #1713690)
-- Steve Beattie <email address hidden> Fri, 05 Oct 2018 16:27:58 -0700
-
git (1:2.17.1-1ubuntu0.2) bionic; urgency=medium
* Build diff-highlight in the contrib dir (closes: #868871, LP: #1713690)
-- Adam Conrad <email address hidden> Thu, 20 Sep 2018 03:34:49 -0600
-
git (1:2.17.1-1ubuntu0.1) bionic-security; urgency=low
* SECURITY UPDATE: arbitrary code execution via submodule names
in .gitsubmodules.
- CVE-2018-11235
* SECURITY UPDATE: out-of-bounds memory when sanity-checking
pathnames on NTFS
- CVE-2018-11233
* Merge from Debian (LP: #1774061). Remaining changes:
- debian/control: build against pcre v3 only
- debian/rules: s390x libpcre3 library has JIT disabled, set
NO_LIBPCRE1_JIT on that arch to stop the build from failing.
git (1:2.17.1-1) unstable; urgency=high
* new upstream point release to fix CVE-2018-11235, arbitary code
execution via submodule names in .gitmodules (see RelNotes/2.17.1.txt).
-- Steve Beattie <email address hidden> Thu, 31 May 2018 10:50:28 -0700
-
git (1:2.17.0-1ubuntu1) bionic; urgency=medium
* Merge with Debian; remaining changes:
- debian/control: build against pcre v3 only
- debian/rules: s390x libpcre3 library has JIT disabled, set
NO_LIBPCRE1_JIT on that arch to stop the build from failing.
git (1:2.17.0-1) unstable; urgency=low
* new upstream release (see RelNotes/2.17.0.txt).
* debian/rules: add NO_USE_CPAN_FALLBACKS=1 to OPTS to avoid
installing bundled copies of perl modules.
* debian/control: Build-Depends: libmailtools-perl, liberror-perl;
git-email: Depends: libmailtools-perl for Mail::Address.
git (1:2.16.3-1) unstable; urgency=low
* new upstream point release (see RelNotes/2.16.3.txt).
git (1:2.16.2-1) unstable; urgency=low
* new upstream point release (see RelNotes/2.16.2.txt).
* debian/control: correct spelling of openssh-client in Breaks
relation.
git (1:2.16.1-1) unstable; urgency=low
* new upstream release (see RelNotes/2.16.txt, RelNotes/2.16.1.txt).
* debian/control: Breaks: openssh-client (<< 1:6.8) since the latter
lacks support for the "-G" option (thx Bryan Turner; see
https://crbug.com/git/7).
* debian/patches/git-gui-Sort-entries-in-optimized-tclIndex.diff:
remove; applied upstream.
* debian/rules: do not install contrib/**/.gitattributes to
/usr/share/doc (thx Paul Wise and Bastien Roucaries for suggesting
it through lintian).
git (1:2.15.1-3) unstable; urgency=low
* debian/rules: remove remnants of git-core package that prevented
building twice in a row (thx Andreas Beckmann; closes: #884890).
git (1:2.15.1-2) unstable; urgency=low
* gitweb: Recommends: 'apache2 (>= 2.4.6-4~) | lynx | httpd' instead
of ... | lynx-cur | ... (thx Łukasz Zemczak; see #490265).
* debian/control: Standards-Version: 4.1.2.0.
-- Matthias Klose <email address hidden> Fri, 06 Apr 2018 16:38:28 +0200
-
git (1:2.15.1-1ubuntu2) bionic; urgency=medium
* debian/gitweb.apache2: use lynx instead of the deprecated transitional
lynx-cur package.
-- Łukasz 'sil2100' Zemczak <email address hidden> Thu, 14 Dec 2017 19:51:49 +0100
-
git (1:2.15.1-1ubuntu1) bionic; urgency=low
* Merge from Debian unstable. LP: #1729075.
* Remaining changes:
- debian/control: build against pcre v3 only
- debian/rules: s390x libpcre3 library has JIT disabled, set
NO_LIBPCRE1_JIT on that arch to stop the build from failing.
* Dropped changes, included upstream:
- debian/patches/git-branch-fix-regressions.patch: Fix branch renaming
not updating HEADs correctly.
- SECURITY UPDATE: Git cvsserver OS Command Injection
git (1:2.15.1-1) unstable; urgency=low
* new upstream point release (see RelNotes/2.15.1.txt).
* debian/control: Build-Depends-Indep: asciidoc (>= 8.6.10).
* debian/control: Standards-Version: 4.1.1.1.
* debian/patches:
* Normalize-generated-asciidoc-timestamps-...diff: remove; no
longer needed (thx Anders Kaseorg; see #782294).
* git-gui-Sort-entries-in-optimized-tclIndex.diff: update to
upstream version.
git (1:2.15.0-1) unstable; urgency=low
* new upstream release (see RelNotes/2.15.0.txt).
git (1:2.15.0~rc2-1) unstable; urgency=low
* new upstream release candidate.
git (1:2.15.0~rc1-1) unstable; urgency=low
* new upstream release candidate.
* remove transitional git-core package (thx Holger Levsen;
closes: #878189).
git (1:2.15.0~rc0-1) unstable; urgency=low
* new upstream release candidate (see RelNotes/2.15.0.txt).
git (1:2.14.2-1) unstable; urgency=high
* new upstream point release (see RelNotes/2.14.1.txt). Among other
changes, this fixes a remote shell command execution vulnerability
via CVS protocol:
- git-shell: drop cvsserver support by default
- git-cvsserver: harden backtick captures against user input
Thanks to joernchen of Phenoelit for discovering, reporting, and
fixing this vulnerability, and to Junio C Hamano and Jeff King for
the fixes to related issues.
git (1:2.14.1-3) unstable; urgency=low
* git.README.Debian: remove obsolete instructions about setting up a
server to handle rsync:// protocol.
git (1:2.14.1-2) unstable; urgency=low
* debian/control: git-daemon-sysvinit: Priority: optional.
* debian/control: clarify how to decide between git-daemon-run and
git-daemon-sysvinit in package descriptions.
* debian/control: Standards-Version: 4.0.1.0.
-- Steve Langasek <email address hidden> Fri, 08 Dec 2017 15:28:09 -0800
-
git (1:2.14.1-1ubuntu4) artful; urgency=high
* SECURITY UPDATE: Git cvsserver OS Command Injection (LP: #1719740)
- shell-drop-git-cvsserver-support-by-default.diff
- cvsserver-use-safe_pipe_capture.diff
- cvsimport-shell-quote-variable-used-in-backticks.diff
- archimport-use-safe_pipe_capture-for-user-input.diff
- CVE-2017-14867
-- Simon Quigley <email address hidden> Tue, 26 Sep 2017 19:11:26 -0500
