Skip to content

Commit 81632a6

Browse files
gitstergitster
committed
Autogenerated HTML docs for v2.45.1-145-g83f1a
1 parent 1365ca3 commit 81632a6

29 files changed

+313
-18
lines changed

‎RelNotes/2.39.4.txt

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
Git v2.39.4 Release Notes
2+
=========================
3+
4+
This addresses the security issues CVE-2024-32002, CVE-2024-32004,
5+
CVE-2024-32020 and CVE-2024-32021.
6+
7+
This release also backports fixes necessary to let the CI builds pass
8+
successfully.
9+
10+
Fixes since v2.39.3
11+
-------------------
12+
13+
* CVE-2024-32002:
14+
15+
Recursive clones on case-insensitive filesystems that support symbolic
16+
links are susceptible to case confusion that can be exploited to
17+
execute just-cloned code during the clone operation.
18+
19+
* CVE-2024-32004:
20+
21+
Repositories can be configured to execute arbitrary code during local
22+
clones. To address this, the ownership checks introduced in v2.30.3
23+
are now extended to cover cloning local repositories.
24+
25+
* CVE-2024-32020:
26+
27+
Local clones may end up hardlinking files into the target repository's
28+
object database when source and target repository reside on the same
29+
disk. If the source repository is owned by a different user, then
30+
those hardlinked files may be rewritten at any point in time by the
31+
untrusted user.
32+
33+
* CVE-2024-32021:
34+
35+
When cloning a local source repository that contains symlinks via the
36+
filesystem, Git may create hardlinks to arbitrary user-readable files
37+
on the same filesystem as the target repository in the objects/
38+
directory.
39+
40+
* CVE-2024-32465:
41+
42+
It is supposed to be safe to clone untrusted repositories, even those
43+
unpacked from zip archives or tarballs originating from untrusted
44+
sources, but Git can be tricked to run arbitrary code as part of the
45+
clone.
46+
47+
* Defense-in-depth: submodule: require the submodule path to contain
48+
directories only.
49+
50+
* Defense-in-depth: clone: when symbolic links collide with directories, keep
51+
the latter.
52+
53+
* Defense-in-depth: clone: prevent hooks from running during a clone.
54+
55+
* Defense-in-depth: core.hooksPath: add some protection while cloning.
56+
57+
* Defense-in-depth: fsck: warn about symlink pointing inside a gitdir.
58+
59+
* Various fix-ups on HTTP tests.
60+
61+
* Test update.
62+
63+
* HTTP Header redaction code has been adjusted for a newer version of
64+
cURL library that shows its traces differently from earlier
65+
versions.
66+
67+
* Fix was added to work around a regression in libcURL 8.7.0 (which has
68+
already been fixed in their tip of the tree).
69+
70+
* Replace macos-12 used at GitHub CI with macos-13.
71+
72+
* ci(linux-asan/linux-ubsan): let's save some time
73+
74+
* Tests with LSan from time to time seem to emit harmless message that makes
75+
our tests unnecessarily flakey; we work it around by filtering the
76+
uninteresting output.
77+
78+
* Update GitHub Actions jobs to avoid warnings against using deprecated
79+
version of Node.js.

‎RelNotes/2.40.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.40.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 to address
5+
the security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
6+
CVE-2024-32021 and CVE-2024-32465; see the release notes for that
7+
version for details.

‎RelNotes/2.41.1.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.41.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4 and v2.40.2
5+
to address the security issues CVE-2024-32002, CVE-2024-32004,
6+
CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465; see the release
7+
notes for these versions for details.

‎RelNotes/2.42.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.42.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2
5+
and v2.41.1 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎RelNotes/2.43.4.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1 and v2.42.2 to address the security issues CVE-2024-32002,
6+
CVE-2024-32004, CVE-2024-32020, CVE-2024-32021 and CVE-2024-32465;
7+
see the release notes for these versions for details.

‎RelNotes/2.44.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.44.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4, v2.40.2,
5+
v2.41.1, v2.42.2 and v2.43.4 to address the security issues
6+
CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021
7+
and CVE-2024-32465; see the release notes for these versions
8+
for details.

‎RelNotes/2.45.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.45.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.39.4,
5+
v2.40.2, v2.41.1, v2.42.2, v2.43.4 and v2.44.1 to address the
6+
security issues CVE-2024-32002, CVE-2024-32004, CVE-2024-32020,
7+
CVE-2024-32021 and CVE-2024-32465; see the release notes for
8+
these versions for details.

‎fsck-msgids.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,18 @@
164164
`nullSha1`::
165165
(WARN) Tree contains entries pointing to a null sha1.
166166

167+
`symlinkPointsToGitDir`::
168+
(WARN) Symbolic link points inside a gitdir.
169+
170+
`symlinkTargetBlob`::
171+
(ERROR) A non-blob found instead of a symbolic link's target.
172+
173+
`symlinkTargetLength`::
174+
(WARN) Symbolic link target longer than maximum path length.
175+
176+
`symlinkTargetMissing`::
177+
(ERROR) Unable to read symbolic link target's blob.
178+
167179
`treeNotSorted`::
168180
(ERROR) A tree is not properly sorted.
169181

‎git-fsck.html

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1507,6 +1507,38 @@ <h2 id="_fsck_messages">FSCK MESSAGES</h2>
15071507
</p>
15081508
</dd>
15091509
<dt class="hdlist1">
1510+
<code>symlinkPointsToGitDir</code>
1511+
</dt>
1512+
<dd>
1513+
<p>
1514+
(WARN) Symbolic link points inside a gitdir.
1515+
</p>
1516+
</dd>
1517+
<dt class="hdlist1">
1518+
<code>symlinkTargetBlob</code>
1519+
</dt>
1520+
<dd>
1521+
<p>
1522+
(ERROR) A non-blob found instead of a symbolic link&#8217;s target.
1523+
</p>
1524+
</dd>
1525+
<dt class="hdlist1">
1526+
<code>symlinkTargetLength</code>
1527+
</dt>
1528+
<dd>
1529+
<p>
1530+
(WARN) Symbolic link target longer than maximum path length.
1531+
</p>
1532+
</dd>
1533+
<dt class="hdlist1">
1534+
<code>symlinkTargetMissing</code>
1535+
</dt>
1536+
<dd>
1537+
<p>
1538+
(ERROR) Unable to read symbolic link target&#8217;s blob.
1539+
</p>
1540+
</dd>
1541+
<dt class="hdlist1">
15101542
<code>treeNotSorted</code>
15111543
</dt>
15121544
<dd>

‎git-upload-pack.html

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -834,10 +834,47 @@ <h2 id="_environment">ENVIRONMENT</h2>
834834
variable to be passed. See the discussion in <a href="git.html">git(1)</a>.
835835
</p>
836836
</dd>
837+
<dt class="hdlist1">
838+
<code>GIT_NO_LAZY_FETCH</code>
839+
</dt>
840+
<dd>
841+
<p>
842+
When cloning or fetching from a partial repository (i.e., one
843+
itself cloned with <code>--filter</code>), the server-side <code>upload-pack</code>
844+
may need to fetch extra objects from its upstream in order to
845+
complete the request. By default, <code>upload-pack</code> will refuse to
846+
perform such a lazy fetch, because <code>git fetch</code> may run arbitrary
847+
commands specified in configuration and hooks of the source
848+
repository (and <code>upload-pack</code> tries to be safe to run even in
849+
untrusted <code>.git</code> directories).
850+
</p>
851+
<div class="paragraph"><p>This is implemented by having <code>upload-pack</code> internally set the
852+
<code>GIT_NO_LAZY_FETCH</code> variable to <code>1</code>. If you want to override it
853+
(because you are fetching from a partial clone, and you are sure
854+
you trust it), you can explicitly set <code>GIT_NO_LAZY_FETCH</code> to
855+
<code>0</code>.</p></div>
856+
</dd>
837857
</dl></div>
838858
</div>
839859
</div>
840860
<div class="sect1">
861+
<h2 id="_security">SECURITY</h2>
862+
<div class="sectionbody">
863+
<div class="paragraph"><p>Most Git commands should not be run in an untrusted <code>.git</code> directory
864+
(see the section <code>SECURITY</code> in <a href="git.html">git(1)</a>). <code>upload-pack</code> tries to
865+
avoid any dangerous configuration options or hooks from the repository
866+
it&#8217;s serving, making it safe to clone an untrusted directory and run
867+
commands on the resulting clone.</p></div>
868+
<div class="paragraph"><p>For an extra level of safety, you may be able to run <code>upload-pack</code> as an
869+
alternate user. The details will be platform dependent, but on many
870+
systems you can run:</p></div>
871+
<div class="literalblock">
872+
<div class="content">
873+
<pre><code>git clone --no-local --upload-pack='sudo -u nobody git-upload-pack' ...</code></pre>
874+
</div></div>
875+
</div>
876+
</div>
877+
<div class="sect1">
841878
<h2 id="_see_also">SEE ALSO</h2>
842879
<div class="sectionbody">
843880
<div class="paragraph"><p><a href="gitnamespaces.html">gitnamespaces(7)</a></p></div>
@@ -854,7 +891,7 @@ <h2 id="_git">GIT</h2>
854891
<div id="footer">
855892
<div id="footer-text">
856893
Last updated
857-
2023-10-23 14:43:46 PDT
894+
2024-05-14 07:52:20 PDT
858895
</div>
859896
</div>
860897
</body>

‎git-upload-pack.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,37 @@ ENVIRONMENT
5555
admins may need to configure some transports to allow this
5656
variable to be passed. See the discussion in linkgit:git[1].
5757

58+
`GIT_NO_LAZY_FETCH`::
59+
When cloning or fetching from a partial repository (i.e., one
60+
itself cloned with `--filter`), the server-side `upload-pack`
61+
may need to fetch extra objects from its upstream in order to
62+
complete the request. By default, `upload-pack` will refuse to
63+
perform such a lazy fetch, because `git fetch` may run arbitrary
64+
commands specified in configuration and hooks of the source
65+
repository (and `upload-pack` tries to be safe to run even in
66+
untrusted `.git` directories).
67+
+
68+
This is implemented by having `upload-pack` internally set the
69+
`GIT_NO_LAZY_FETCH` variable to `1`. If you want to override it
70+
(because you are fetching from a partial clone, and you are sure
71+
you trust it), you can explicitly set `GIT_NO_LAZY_FETCH` to
72+
`0`.
73+
74+
SECURITY
75+
--------
76+
77+
Most Git commands should not be run in an untrusted `.git` directory
78+
(see the section `SECURITY` in linkgit:git[1]). `upload-pack` tries to
79+
avoid any dangerous configuration options or hooks from the repository
80+
it's serving, making it safe to clone an untrusted directory and run
81+
commands on the resulting clone.
82+
83+
For an extra level of safety, you may be able to run `upload-pack` as an
84+
alternate user. The details will be platform dependent, but on many
85+
systems you can run:
86+
87+
git clone --no-local --upload-pack='sudo -u nobody git-upload-pack' ...
88+
5889
SEE ALSO
5990
--------
6091
linkgit:gitnamespaces[7]

‎git.html

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3817,6 +3817,35 @@ <h2 id="_discussion_a_id_discussion_a">Discussion<a id="Discussion"></a></h2>
38173817
</div>
38183818
</div>
38193819
<div class="sect1">
3820+
<h2 id="_security">SECURITY</h2>
3821+
<div class="sectionbody">
3822+
<div class="paragraph"><p>Some configuration options and hook files may cause Git to run arbitrary
3823+
shell commands. Because configuration and hooks are not copied using
3824+
<code>git clone</code>, it is generally safe to clone remote repositories with
3825+
untrusted content, inspect them with <code>git log</code>, and so on.</p></div>
3826+
<div class="paragraph"><p>However, it is not safe to run Git commands in a <code>.git</code> directory (or
3827+
the working tree that surrounds it) when that <code>.git</code> directory itself
3828+
comes from an untrusted source. The commands in its config and hooks
3829+
are executed in the usual way.</p></div>
3830+
<div class="paragraph"><p>By default, Git will refuse to run when the repository is owned by
3831+
someone other than the user running the command. See the entry for
3832+
<code>safe.directory</code> in <a href="git-config.html">git-config(1)</a>. While this can help protect
3833+
you in a multi-user environment, note that you can also acquire
3834+
untrusted repositories that are owned by you (for example, if you
3835+
extract a zip file or tarball from an untrusted source). In such cases,
3836+
you&#8217;d need to "sanitize" the untrusted repository first.</p></div>
3837+
<div class="paragraph"><p>If you have an untrusted <code>.git</code> directory, you should first clone it
3838+
with <code>git clone --no-local</code> to obtain a clean copy. Git does restrict
3839+
the set of options and hooks that will be run by <code>upload-pack</code>, which
3840+
handles the server side of a clone or fetch, but beware that the
3841+
surface area for attack against <code>upload-pack</code> is large, so this does
3842+
carry some risk. The safest thing is to serve the repository as an
3843+
unprivileged user (either via <a href="git-daemon.html">git-daemon(1)</a>, ssh, or using
3844+
other tools to change user ids). See the discussion in the <code>SECURITY</code>
3845+
section of <a href="git-upload-pack.html">git-upload-pack(1)</a>.</p></div>
3846+
</div>
3847+
</div>
3848+
<div class="sect1">
38203849
<h2 id="_further_documentation">FURTHER DOCUMENTATION</h2>
38213850
<div class="sectionbody">
38223851
<div class="paragraph"><p>See the references in the "description" section to get started
@@ -3879,7 +3908,7 @@ <h2 id="_git">GIT</h2>
38793908
<div id="footer">
38803909
<div id="footer-text">
38813910
Last updated
3882-
2024-03-25 17:24:49 PDT
3911+
2024-05-14 07:52:20 PDT
38833912
</div>
38843913
</div>
38853914
</body>

‎git.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,37 @@ The index is also capable of storing multiple entries (called "stages")
10671067
for a given pathname. These stages are used to hold the various
10681068
unmerged version of a file when a merge is in progress.
10691069

1070+
SECURITY
1071+
--------
1072+
1073+
Some configuration options and hook files may cause Git to run arbitrary
1074+
shell commands. Because configuration and hooks are not copied using
1075+
`git clone`, it is generally safe to clone remote repositories with
1076+
untrusted content, inspect them with `git log`, and so on.
1077+
1078+
However, it is not safe to run Git commands in a `.git` directory (or
1079+
the working tree that surrounds it) when that `.git` directory itself
1080+
comes from an untrusted source. The commands in its config and hooks
1081+
are executed in the usual way.
1082+
1083+
By default, Git will refuse to run when the repository is owned by
1084+
someone other than the user running the command. See the entry for
1085+
`safe.directory` in linkgit:git-config[1]. While this can help protect
1086+
you in a multi-user environment, note that you can also acquire
1087+
untrusted repositories that are owned by you (for example, if you
1088+
extract a zip file or tarball from an untrusted source). In such cases,
1089+
you'd need to "sanitize" the untrusted repository first.
1090+
1091+
If you have an untrusted `.git` directory, you should first clone it
1092+
with `git clone --no-local` to obtain a clean copy. Git does restrict
1093+
the set of options and hooks that will be run by `upload-pack`, which
1094+
handles the server side of a clone or fetch, but beware that the
1095+
surface area for attack against `upload-pack` is large, so this does
1096+
carry some risk. The safest thing is to serve the repository as an
1097+
unprivileged user (either via linkgit:git-daemon[1], ssh, or using
1098+
other tools to change user ids). See the discussion in the `SECURITY`
1099+
section of linkgit:git-upload-pack[1].
1100+
10701101
FURTHER DOCUMENTATION
10711102
---------------------
10721103

‎howto/coordinate-embargoed-releases.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1038,7 +1038,7 @@ <h3 id="_example_mail_to_a_href_mailto_oss_security_lists_openwall_com_oss_secur
10381038
<div id="footer">
10391039
<div id="footer-text">
10401040
Last updated
1041-
2024-05-13 12:27:19 PDT
1041+
2024-05-14 07:52:43 PDT
10421042
</div>
10431043
</div>
10441044
</body>

‎howto/keep-canonical-history-correct.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,7 @@ <h1>Keep authoritative canonical history correct with git pull</h1>
939939
<div id="footer">
940940
<div id="footer-text">
941941
Last updated
942-
2024-05-13 12:27:19 PDT
942+
2024-05-14 07:52:43 PDT
943943
</div>
944944
</div>
945945
</body>

‎howto/maintain-git.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1479,7 +1479,7 @@ <h3 id="_preparing_a_merge_fix">Preparing a "merge-fix"</h3>
14791479
<div id="footer">
14801480
<div id="footer-text">
14811481
Last updated
1482-
2024-05-13 12:27:19 PDT
1482+
2024-05-14 07:52:43 PDT
14831483
</div>
14841484
</div>
14851485
</body>

0 commit comments

Comments
 (0)