55 lines
2.1 KiB
Plaintext
55 lines
2.1 KiB
Plaintext
|
Git v2.14.6 Release Notes
|
||
|
|
=========================
|
||
|
|
|
||
|
|
This release addresses the security issues CVE-2019-1348,
|
||
|
|
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
|
||
|
|
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387.
|
||
|
|
|
||
|
|
Fixes since v2.14.5
|
||
|
|
-------------------
|
||
|
|
|
||
|
|
* CVE-2019-1348:
|
||
|
|
The --export-marks option of git fast-import is exposed also via
|
||
|
|
the in-stream command feature export-marks=... and it allows
|
||
|
|
overwriting arbitrary paths.
|
||
|
|
|
||
|
|
* CVE-2019-1349:
|
||
|
|
When submodules are cloned recursively, under certain circumstances
|
||
|
|
Git could be fooled into using the same Git directory twice. We now
|
||
|
|
require the directory to be empty.
|
||
|
|
|
||
|
|
* CVE-2019-1350:
|
||
|
|
Incorrect quoting of command-line arguments allowed remote code
|
||
|
|
execution during a recursive clone in conjunction with SSH URLs.
|
||
|
|
|
||
|
|
* CVE-2019-1351:
|
||
|
|
While the only permitted drive letters for physical drives on
|
||
|
|
Windows are letters of the US-English alphabet, this restriction
|
||
|
|
does not apply to virtual drives assigned via subst <letter>:
|
||
|
|
<path>. Git mistook such paths for relative paths, allowing writing
|
||
|
|
outside of the worktree while cloning.
|
||
|
|
|
||
|
|
* CVE-2019-1352:
|
||
|
|
Git was unaware of NTFS Alternate Data Streams, allowing files
|
||
|
|
inside the .git/ directory to be overwritten during a clone.
|
||
|
|
|
||
|
|
* CVE-2019-1353:
|
||
|
|
When running Git in the Windows Subsystem for Linux (also known as
|
||
|
|
"WSL") while accessing a working directory on a regular Windows
|
||
|
|
drive, none of the NTFS protections were active.
|
||
|
|
|
||
|
|
* CVE-2019-1354:
|
||
|
|
Filenames on Linux/Unix can contain backslashes. On Windows,
|
||
|
|
backslashes are directory separators. Git did not use to refuse to
|
||
|
|
write out tracked files with such filenames.
|
||
|
|
|
||
|
|
* CVE-2019-1387:
|
||
|
|
Recursive clones are currently affected by a vulnerability that is
|
||
|
|
caused by too-lax validation of submodule names, allowing very
|
||
|
|
targeted attacks via remote code execution in recursive clones.
|
||
|
|
|
||
|
|
Credit for finding these vulnerabilities goes to Microsoft Security
|
||
|
|
Response Center, in particular to Nicolas Joly. The `fast-import`
|
||
|
|
fixes were provided by Jeff King, the other fixes by Johannes
|
||
|
|
Schindelin with help from Garima Singh.
|