Maintenance releases Git v2.10.5, v2.11.4, v2.12.5 and v2.13.6 are
now available at the usual places. These are solely about hardening
"git shell" that is used on servers against an unsafe user input,
which "git cvsserver" copes with poorly. A copy of the release notes
for v2.10.5 is attached at the end of the message, but the notes for
other releases listed above essentially say the same thing.
The tarballs are found at:
https://www.kernel.org/pub/software/scm/git/
The following public repositories all have a copy of the 'v2.10.5',
'v2.11.4', 'v2.12.5' and 'v2.13.6' tags and some of them have the
'maint-2.10', 'maint-2.11', 'maint-2.12' and 'maint-2.13' branches
that the tags point at:
url = https://kernel.googlesource.com/pub/scm/git/git
url = git://repo.or.cz/alt-git.git
url = https://github.com/gitster/git
Note that the committed version of the release notes for these
versions all incorrectly mention "git daemon", where they should
have said "git shell". It has been corrected in the attached copy,
but because the release engineering was done several days in advance
and the tags have already been shared with binary packagers and
others at the git-security@xxxxxxxxxxxxxxxx mailing list, these
release tarballs are issued _with_ the known typo to avoid confusion
of having two release tags with different contents. Sorry about that.
----------------------------------------------------------------
Git v2.10.5 Release Notes
=========================
Fixes since v2.10.4
-------------------
* "git cvsserver" no longer is invoked by "git shell" by default,
as it is old and largely unmaintained.
* Various Perl scripts did not use safe_pipe_capture() instead of
backticks, leaving them susceptible to end-user input. They have
been corrected.
Credits go to joernchen <joernchen@xxxxxxxxxxxx> for finding the
unsafe constructs in "git cvsserver", and to Jeff King at GitHub for
finding and fixing instances of the same issue in other scripts.
----------------------------------------------------------------
Changes since v2.10.4 are as follows:
Jeff King (3):
shell: drop git-cvsserver support by default
archimport: use safe_pipe_capture for user input
cvsimport: shell-quote variable used in backticks
Junio C Hamano (3):
cvsserver: move safe_pipe_capture() to the main package
cvsserver: use safe_pipe_capture for `constant commands` as well
Git 2.10.5
joernchen (1):
cvsserver: use safe_pipe_capture instead of backticks
