8000 Sync with Git 2.45.1 · git/git@83f1add · GitHub
[go: up one dir, main page]
Skip to content

Commit 83f1add

Browse files
gitstergitster
committed
Sync with Git 2.45.1
* tag 'v2.45.1': (42 commits) Git 2.45.1 Git 2.44.1 Git 2.43.4 Git 2.42.2 Git 2.41.1 Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks ...
2 parents 3e4a232 + 2c7b491 commit 83f1add

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1283
-86
lines changed

‎Documentation/RelNotes/2.39.4.txt

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
Git v2.39.4 Release Notes
2+
=========================
3+
4+
This addresses the security issues CVE-2024-32002, CVE-2024-32004,
5+
CVE-2024-32020 and CVE-2024-32021.
6+
7+
This release also backports fixes necessary to let the CI builds pass
8+
successfully.
9+
10+
Fixes since v2.39.3
11+
-------------------
12+
13+
* CVE-2024-32002:
14+
15+
Recursive clones on case-insensitive filesystems that support symbolic
16+
links are susceptible to case confusion that can be exploited to
17+
execute just-cloned code during the clone operation.
18+
19+
* CVE-2024-32004:
20+
21+
Repositories can be configured to execute arbitrary code during local
22+
clones. To address this, the ownership checks introduced in v2.30.3
23+
are now extended to cover cloning local repositories.
24+
25+
* CVE-2024-32020:
26+
27+
Local clones may end up hardlinking files into the target repository's
28+
object database when source and target repository reside on the same
29+
disk. If the source repository is owned by a different user, then
30+
those hardlinked files may be rewritten at any point in time by the
31+
untrusted user.
32+
33+
* CVE-2024-32021:
34+
35+
When cloning a local source repository that contains symlinks via the
36+
filesystem, Git may create hardlinks to arbitrary user-readable files
37+
on the same filesystem as the target repository in the objects/
38+
directory.
39+
40+
* CVE-2024-32465:
41+
42+
It is supposed to be safe to clone untrusted repositories, even those
43+
unpacked from zip archives or tarballs originating from untrusted
44+
sources, but Git can be tricked to run arbitrary code as part of the
45+
clone.
46+
47+
* Defense-in-depth: submodule: require the submodule path to contain
48+
directories only.
49+
50+
* Defense-in-depth: clone: when symbolic links collide with directories, keep
51+
the latter.
52+
53+
* Defense-in-depth: clone: prevent hooks from running during a clone.
54+
55+
* Defense-in-depth: core.hooksPath: add some protection while cloning.
56+
57+
* Defense-in-depth: fsck: warn about symlink pointing inside a gitdir.
58+
59+
* Various fix-ups on HTTP tests.
60+
61+
* Test update.
62+
63+
* HTTP Header redaction code has been adjusted for a newer version of
64+
cURL library that shows its traces differently from earlier
65+
versions.
66+
67+
* Fix was added to work around a regression in libcURL 8.7.0 (which has
68+
already been fixed in their tip of the tree).
69+
70+
* Replace macos-12 used at GitHub CI with macos-13.
71+
72+
* ci(linux-asan/linux-ubsan): let's save some time
73+
74+
* Tests with LSan from time to time seem to emit harmless message that makes
75+
our tests unnecessarily flakey; we work it around by filtering the
76+
uninteresting output.
77+
78+
* Update GitHub Actions jobs to avoid warnings against using deprecated
79+
version of Node.js.

‎Documentation/RelNotes/2.40.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.40.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 to address
5+
the security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
6+
CVE-2024-32021 and CVE-2024-32465; see the release notes for that
7+
version for details.

‎Documentation/RelNotes/2.41.1.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.41.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 and v2.40.2
5+
to address the security issues CVE-2024-32002, CVE-2024-32004,
6+
CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; see the release
7+
notes for these versions for details.

‎Documentation/RelNotes/2.42.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.42.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2
5+
and v2.41.1 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.43.4.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1 and v2.42.2 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.44.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.44.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1, v2.42.2 and v2.43.4 to address the security issues
6+
CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021
7+
and CVE-2024-32465; see the release notes for these versions
8+
for details.

‎Documentation/RelNotes/2.45.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.45.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4,
5+
v2.40.2, v2.41.1, v2.42.2, v2.43.4 and v2.44.1 to address the
6+
security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
7+
CVE-2024-32021 and CVE-2024-32465; see the release notes for
8+
these versions for details.

‎Documentation/fsck-msgids.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,18 @@
164164
`nullSha1`::
165165
(WARN) Tree contains entries pointing to a null sha1.
166166

167+
`symlinkPointsToGitDir`::
168+
(WARN) Symbolic link points inside a gitdir.
169+
170+
`symlinkTargetBlob`::
171+
(ERROR) A non-blob found instead of a symbolic link's target.
172+
173+
`symlinkTargetLength`::
174+
(WARN) Symbolic link target longer than maximum path length.
175+
176+
`symlinkTargetMissing`::
177+
(ERROR) Unable to read symbolic link target's blob.
178+
167179
`treeNotSorted`::
168180
(ERROR) A tree is not properly sorted.
169181

‎Documentation/git-upload-pack.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,37 @@ ENVIRONMENT
5555
admins may need to configure some transports to allow this
5656
variable to be passed. See the discussion in linkgit:git[1].
5757

58+
`GIT_NO_LAZY_FETCH`::
59+
When cloning or fetching from a partial repository (i.e., one
60+
itself cloned with `--filter`), the server-side `upload-pack`
61+
may need to fetch extra objects from its upstream in order to
62+
complete the request. By default, `upload-pack` will refuse to
63+
perform such a lazy fetch, because `git fetch` may run arbitrary
64+
commands specified in configuration and hooks of the source
65+
repository (and `upload-pack` tries to be safe to run even in
66+
untrusted `.git` directories).
67+
+
68+
This is implemented by having `upload-pack` internally set the
69+
`GIT_NO_LAZY_FETCH` variable to `1`. If you want to override it
70+
(because you are fetching from a partial clone, and you are sure
71+
you trust it), you can explicitly set `GIT_NO_LAZY_FETCH` to
72+
`0`.
73+
74+
SECURITY
75+
--------
76+
77+
Most Git commands should not be run in an untrusted `.git` directory
78+
(see the section `SECURITY` in linkgit:git[1]). `upload-pack` tries to
79+
avoid any dangerous configuration options or hooks from the repository
80+
it's serving, making it safe to clone an untrusted directory and run
81+
commands on the resulting clone.
82+
83+
For an extra level of safety, you may be able to run `upload-pack` as an
84+
alternate user. The details will be platform dependent, but on many
85+
systems you can run:
86+
87+
git clone --no-local --upload-pack='sudo -u nobody git-upload-pack' ...
88+
5889
SEE ALSO
5990
--------
6091
linkgit:gitnamespaces[7]

‎Documentation/git.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,37 @@ The index is also capable of storing multiple entries (called "stages")
10671067
for a given pathname. These stages are used to hold the various
10681068
unmerged version of a file when a merge is in progress.
10691069

1070+
SECURITY
1071+
--------
1072+
1073+
Some configuration options and hook files may cause Git to run arbitrary
1074+
shell commands. Because configuration and hooks are not copied using
1075+
`git clone`, it is generally safe to clone remote repositories with
1076+
untrusted content, inspect them with `git log`, and so on.
1077+
1078+
However, it is not safe to run Git commands in a `.git` directory (or
1079+
the working tree that surrounds it) when that `.git` directory itself
1080+
comes from an untrusted source. The commands in its config and hooks
1081+
are executed in the usual way.
1082+
1083+
By default, Git will refuse to run when the repository is owned by
1084+
someone other than the user running the command. See the entry for
1085+
`safe.directory` in linkgit:git-config[1]. While this can help protect
1086+
you in a multi-user environment, note that you can also acquire
1087+
untrusted repositories that are owned by you (for example, if you
1088+
extract a zip file or tarball from an untrusted source). In such cases,
1089+
you'd need to "sanitize" the untrusted repository first.
1090+
1091+
If you have an untrusted `.git` directory, you should first clone it
1092+
with `git clone --no-local` to obtain a clean copy. Git does restrict
1093+
the set of options and hooks that will be run by `upload-pack`, which
1094+
handles the server side of a clone or fetch, but beware that the
1095+
surface area for attack against `upload-pack` is large, so this does
1096+
carry some risk. The safest thing is to serve the repository as an
1097+
unprivileged user (either via linkgit:git-daemon[1], ssh, or using
1098+
other tools to change user ids). See the discussion in the `SECURITY`
1099+
section of linkgit:git-upload-pack[1].
1100+
10701101
FURTHER DOCUMENTATION
10711102
---------------------
10721103

0 commit comments

Comments
 (0)
0