[ANNOUNCE] Git 2.39.1 and others

[ANNOUNCE] Git 2.39.1 and others

[Junio C Hamano]

A maintenance release v2.39.1, together with releases for older
maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6,
v2.33.6, v2.32.5, v2.31.6, and v2.30.7, are now available at the
usual places.

These maintenance releases are to address the security issues
identified as CVE-2022-41903 and CVE-2022-23521.

The tarballs are found at:

    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the v2.39.1
tag, as well as the tags for older maintenance tracks for v2.30.7,
v2.31.6, v2.32.5, v2.33.6, v2.34.6, v2.35.6, v2.36.4, v2.37.5, and
v2.38.3.

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = git://repo.or.cz/alt-git.git
  url = https://github.com/gitster/git

 * CVE-2022-41903:

   git log has the ability to display commits using an arbitrary
   format with its --format specifiers. This functionality is also
   exposed to git archive via the export-subst gitattribute.

   When processing the padding operators (e.g., %<(, %<|(, %>(,
   %>>(, or %><( ), an integer overflow can occur in
   pretty.c::format_and_pad_commit() where a size_t is improperly
   stored as an int, and then added as an offset to a subsequent
   memcpy() call.

   This overflow can be triggered directly by a user running a
   command which invokes the commit formatting machinery (e.g., git
   log --format=...). It may also be triggered indirectly through
   git archive via the export-subst mechanism, which expands format
   specifiers inside of files within the repository during a git
   archive.

   This integer overflow can result in arbitrary heap writes, which
   may result in remote code execution.

* CVE-2022-23521:

    gitattributes are a mechanism to allow defining attributes for
    paths. These attributes can be defined by adding a `.gitattributes`
    file to the repository, which contains a set of file patterns and
    the attributes that should be set for paths matching this pattern.

    When parsing gitattributes, multiple integer overflows can occur
    when there is a huge number of path patterns, a huge number of
    attributes for a single pattern, or when the declared attribute
    names are huge.

    These overflows can be triggered via a crafted `.gitattributes` file
    that may be part of the commit history. Git silently splits lines
    longer than 2KB when parsing gitattributes from a file, but not when
    parsing them from the index. Consequentially, the failure mode
    depends on whether the file exists in the working tree, the index or
    both.

    This integer overflow can result in arbitrary heap reads and writes,
    which may result in remote code execution.

Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.
An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for
finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41
D-Sec. This work was sponsored by OSTIF.

The proposed fixes have been polished and extended to cover additional
findings by Patrick Steinhardt of GitLab, with help from others on the
Git security mailing list.

Re: [ANNOUNCE] Git 2.39.1 and others

[Ramsay Jones]

On 17/01/2023 18:02, Junio C Hamano wrote:
> A maintenance release v2.39.1, together with releases for older
> maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6,
> v2.33.6, v2.32.5, v2.31.6, and v2.30.7, are now available at the
> usual places.

FYI:

$ git tag -v v2.30.7
object b7b37a33711e64bf580ef3141878b12a36e28833
type commit
tag v2.30.7
tagger Junio C Hamano <gitster@pobox.com> 1670933134 +0900

Git 2.30.7
gpg: Signature made 13 Dec 2022 12:05:34 GMT
gpg:                using RSA key B0B5E88696AFE6CB
gpg: Good signature from "Junio C Hamano <gitster@pobox.com>"
gpg:                 aka "Junio C Hamano <jch@google.com>"
gpg:                 aka "Junio C Hamano <junio@pobox.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 96E0 7AF2 5771 9559 80DA  D100 20D0 4E5A 7136 60A7
     Subkey fingerprint: E1F0 36B1 FEE7 221F C778  ECEF B0B5 E886 96AF E6CB

$ git tag -v v2.31.6
object 82689d5e5d3f41da2ab1fbf9fbe7aacfd6da74c1
type commit
tag v2.31.6
tagger Junio C Hamano <gitster@pobox.com> 1670933242 +0900

Git 2.31.6
error: no signature found

$ git tag -v v2.32.5
object d96ea538e8dd0fcf381089a3b09c0a9af3617351
type commit
tag v2.32.5
tagger Junio C Hamano <gitster@pobox.com> 1670933456 +0900

Git 2.32.5
error: no signature found

$ git tag -v v2.33.6
object 7fe9bf55b84d2610a7ac09893b25ef188f145a21
type commit
tag v2.33.6
tagger Junio C Hamano <gitster@pobox.com> 1670933643 +0900

Git 2.33.6
error: no signature found

$ git tag -v v2.34.6
object 6c9466944c90c236217ec6f9ce5ed6b0e73903f9
type commit
tag v2.34.6
tagger Junio C Hamano <gitster@pobox.com> 1670933752 +0900

Git 2.34.6
error: no signature found

$ git tag -v v2.35.6
object 02f498172348f7ba9dceb169305b74c7eca7a38d
type commit
tag v2.35.6
tagger Junio C Hamano <gitster@pobox.com> 1670933877 +0900

Git 2.35.6
error: no signature found

$ git tag -v v2.36.4
object ad949b24f8d6ee4767c07794a2f01ada91b46b74
type commit
tag v2.36.4
tagger Junio C Hamano <gitster@pobox.com> 1670933982 +0900

Git 2.36.4
error: no signature found

$ git tag -v v2.37.5
object e43ac5f23d3231f6433558931296d555592e978a
type commit
tag v2.37.5
tagger Junio C Hamano <gitster@pobox.com> 1670934063 +0900

Git 2.37.5
error: no signature found

$ git tag -v v2.38.3
object 37ed7bf0f13d204ccb6b8e7e2fbcf7b3bf13e25c
type commit
tag v2.38.3
tagger Junio C Hamano <gitster@pobox.com> 1670934268 +0900

Git 2.38.3
error: no signature found

$ git tag -v v2.39.1
object 01443f01b7c6a3c6ef03268b649b119027743115
type commit
tag v2.39.1
tagger Junio C Hamano <gitster@pobox.com> 1670934343 +0900

Git 2.39.1
error: no signature found

$ 


ATB,
Ramsay Jones

Re: [ANNOUNCE] Git 2.39.1 and others

[Junio C Hamano]

Ramsay Jones <ramsay@ramsayjones.plus.com> writes:

> $ git tag -v v2.31.6
> object 82689d5e5d3f41da2ab1fbf9fbe7aacfd6da74c1
> type commit
> tag v2.31.6
> tagger Junio C Hamano <gitster@pobox.com> 1670933242 +0900
>
> Git 2.31.6
> error: no signature found

Oops.  Corrected.  Thanks.