In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2147 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: arbitrary code execution when recursively cloning a malicious repository (CVE-2018-11235)

    * git: path sanity check in is_ntfs_dotgit() can read arbitrary memory (CVE-2018-11233)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for git fixes the following issues :

Security issues fixed :

  - CVE-2020-11008: Specially crafted URLs may have tricked     the credentials helper to providing credential     information that is not appropriate for the protocol in     use and host being contacted (bsc#1169936)

git was updated to 2.26.1 (bsc#1169786, jsc#ECO-1628, bsc#1149792)

  - Fix git-daemon not starting after conversion from     sysvinit to systemd service (bsc#1169605).

  - CVE-2020-5260: Specially crafted URLs with newline     characters could have been used to make the Git client     to send credential information for a wrong host to the     attacker's site bsc#1168930

git 2.26.0 (bsc#1167890, jsc#SLE-11608) :

  - 'git rebase' now uses a different backend that is based     on the 'merge' machinery by default. The     'rebase.backend' configuration variable reverts to old     behaviour when set to 'apply'

  - Improved handling of sparse checkouts

  - Improvements to many commands and internal features

git 2.25.2 :

  - bug fixes to various subcommands in specific operations

git 2.25.1 :

  - 'git commit' now honors advise.statusHints

  - various updates, bug fixes and documentation updates

git 2.25.0

  - The branch description ('git branch --edit-description')     has been used to fill the body of the cover letters by     the format-patch command; this has been enhanced so that     the subject can also be filled.

  - A few commands learned to take the pathspec from the     standard input or a named file, instead of taking it as     the command line arguments, with the     '--pathspec-from-file' option.

  - Test updates to prepare for SHA-2 transition continues.

  - Redo 'git name-rev' to avoid recursive calls.

  - When all files from some subdirectory were renamed to     the root directory, the directory rename heuristics     would fail to detect that as a rename/merge of the     subdirectory to the root directory, which has been     corrected.

  - HTTP transport had possible allocator/deallocator     mismatch, which has been corrected.

git 2.24.1 :

  - CVE-2019-1348: The --export-marks option of fast-import     is exposed also via the in-stream command feature     export-marks=... and it allows overwriting arbitrary     paths (bsc#1158785)

  - CVE-2019-1349: on Windows, when submodules are cloned     recursively, under certain circumstances Git could be     fooled into using the same Git directory twice     (bsc#1158787)

  - CVE-2019-1350: Incorrect quoting of command-line     arguments allowed remote code execution during a     recursive clone in conjunction with SSH URLs     (bsc#1158788)

  - CVE-2019-1351: on Windows mistakes drive letters outside     of the US-English alphabet as relative paths     (bsc#1158789)

  - CVE-2019-1352: on Windows was unaware of NTFS Alternate     Data Streams (bsc#1158790)

  - CVE-2019-1353: when run in the Windows Subsystem for     Linux while accessing a working directory on a regular     Windows drive, none of the NTFS protections were active     (bsc#1158791)

  - CVE-2019-1354: on Windows refuses to write tracked files     with filenames that contain backslashes (bsc#1158792)

  - CVE-2019-1387: Recursive clones vulnerability that is     caused by too-lax validation of submodule names,     allowing very targeted attacks via remote code execution     in recursive clones (bsc#1158793)

  - CVE-2019-19604: a recursive clone followed by a     submodule update could execute code contained within the     repository without the user explicitly having asked for     that (bsc#1158795)

git 2.24.0

  - The command line parser learned '--end-of-options'     notation.

  - A mechanism to affect the default setting for a     (related) group of configuration variables is     introduced.

  - 'git fetch' learned '--set-upstream' option to help     those who first clone from their private fork they     intend to push to, add the true upstream via 'git remote     add' and then 'git fetch' from it.

  - fixes and improvements to UI, workflow and features,     bash completion fixes

git 2.23.0 :

  - The '--base' option of 'format-patch' computed the     patch-ids for prerequisite patches in an unstable way,     which has been updated to compute in a way that is     compatible with 'git patch-id

    --stable'.

  - The 'git log' command by default behaves as if the
    --mailmap option was given.

  - fixes and improvements to UI, workflow and features

git 2.22.1

  - A relative pathname given to 'git init --template=<path>     <repo>' ought to be relative to the directory 'git init'     gets invoked in, but it instead was made relative to the     repository, which has been corrected.

  - 'git worktree add' used to fail when another worktree     connected to the same repository was corrupt, which has     been corrected.

  - 'git am -i --resolved' segfaulted after trying to see a     commit as if it were a tree, which has been corrected.

  - 'git merge --squash' is designed to update the working     tree and the index without creating the commit, and this     cannot be countermanded by adding the '--commit' option;
    the command now refuses to work when both options are     given.

  - Update to Unicode 12.1 width table.

  - 'git request-pull' learned to warn when the ref we ask     them to pull from in the local repository and in the     published repository are different.

  - 'git fetch' into a lazy clone forgot to fetch base     objects that are necessary to complete delta in a thin     packfile, which has been corrected.

  - The URL decoding code has been updated to avoid going     past the end of the string while parsing %-<hex>-<hex>     sequence.

  - 'git clean' silently skipped a path when it cannot     lstat() it; now it gives a warning.

  - 'git rm' to resolve a conflicted path leaked an internal     message 'needs merge' before actually removing the path,     which was confusing. This has been corrected.

  - Many more bugfixes and code cleanups.

  - removal of SuSEfirewall2 service, since SuSEfirewall2     has been replaced by firewalld.

  - partial fix for git instaweb giving 500 error     (bsc#1112230)

git 2.22.0 

  - The filter specification '--filter=sparse:path=<path>'     used to create a lazy/partial clone has been removed.
    Using a blob that is part of the project as sparse     specification is still supported with the     '--filter=sparse:oid=<blob>' option

  - 'git checkout --no-overlay' can be used to trigger a new     mode of checking out paths out of the tree-ish, that     allows paths that match the pathspec that are in the     current index and working tree and are not in the     tree-ish.

  - Four new configuration variables     (author,committer).(name,email) have been introduced to     override user.(name,email) in more specific cases.

  - 'git branch' learned a new subcommand '--show-current'.

  - The command line completion (in contrib/) has been     taught to complete more subcommand parameters.

  - The completion helper code now pays attention to     repository-local configuration (when available), which     allows --list-cmds to honour a repository specific     setting of completion.commands, for example.

  - The list of conflicted paths shown in the editor while     concluding a conflicted merge was shown above the     scissors line when the clean-up mode is set to     'scissors', even though it was commented out just like     the list of updated paths and other information to help     the user explain the merge better.

  - 'git rebase' that was reimplemented in C did not set     ORIG_HEAD correctly, which has been corrected.

  - 'git worktree add' used to do a 'find an available name     with stat and then mkdir', which is race-prone. This has     been fixed by using mkdir and reacting to EEXIST in a     loop. 

  - Move to DocBook 5.x. Asciidoctor 2.x no longer supports     the legacy DocBook 4.5 format.

  - update git-web AppArmor profile for bash and tar     usrMerge (bsc#1132350)

git 2.21.0

  - Historically, the '-m' (mainline) option can only be     used for 'git cherry-pick' and 'git revert' when working     with a merge commit. This version of Git no longer warns     or errors out when working with a single-parent commit,     as long as the argument to the '-m' option is 1 (i.e. it     has only one parent, and the request is to pick or     revert relative to that first parent). Scripts that     relied on the behaviour may get broken with this change.

  - Small fixes and features for fast-export and     fast-import.

  - The 'http.version' configuration variable can be used     with recent enough versions of cURL library to force the     version of HTTP used to talk when fetching and pushing.

  - 'git push $there $src:$dst' rejects when $dst is not a     fully qualified refname and it is not clear what the end     user meant.

  - Update 'git multimail' from the upstream.

  - A new date format '--date=human' that morphs its output     depending on how far the time is from the current time     has been introduced. '--date=auto:human' can be used to     use this new format (or any existing format) when the     output is going to the pager or to the terminal, and     otherwise the default format.

  - Fix worktree creation race (bsc#1114225).

  - add shadow build dependency to the -daemon subpackage.

git 2.20.1 :

  - portability fixes

  - 'git help -a' did not work well when an overly long     alias was defined

  - no longer squelched an error message when the     run_command API failed to run a missing command

git 2.20.0

  - 'git help -a' now gives verbose output (same as 'git     help -av'). Those who want the old output may say 'git     help --no-verbose -a'..

  - 'git send-email' learned to grab address-looking string     on any trailer whose name ends with '-by'.

  - 'git format-patch' learned new '--interdiff' and     '--range-diff' options to explain the difference between     this version and the previous attempt in the cover     letter (or after the three-dashes as a comment).

  - Developer builds now use -Wunused-function compilation     option.

  - Fix a bug in which the same path could be registered     under multiple worktree entries if the path was missing     (for instance, was removed manually). Also, as a     convenience, expand the number of cases in which --force     is applicable.

  - The overly large Documentation/config.txt file have been     split into million little pieces. This potentially     allows each individual piece to be included into the     manual page of the command it affects more easily.

  - Malformed or crafted data in packstream can make our     code attempt to read or write past the allocated buffer     and abort, instead of reporting an error, which has been     fixed.

  - Fix for a long-standing bug that leaves the index file     corrupt when it shrinks during a partial commit.

  - 'git merge' and 'git pull' that merges into an unborn     branch used to completely ignore '--verify-signatures',     which has been corrected.

  - ...and much more features and fixes

git 2.19.2 :

  - various bug fixes for multiple subcommands and     operations

git 2.19.1 :

  - CVE-2018-17456: Specially crafted .gitmodules files may     have allowed arbitrary code execution when the     repository is cloned with --recurse-submodules     (bsc#1110949)

git 2.19.0 :

  - 'git diff' compares the index and the working tree. For     paths added with intent-to-add bit, the command shows     the full contents of them as added, but the paths     themselves were not marked as new files. They are now     shown as new by default.

  - 'git apply' learned the '--intent-to-add' option so that     an otherwise working-tree-only application of a patch     will add new paths to the index marked with the     'intent-to-add' bit.

  - 'git grep' learned the '--column' option that gives not     just the line number but the column number of the hit.

  - The '-l' option in 'git branch -l' is an unfortunate     short-hand for '--create-reflog', but many users, both     old and new, somehow expect it to be something else,     perhaps '--list'. This step warns when '-l' is used as a     short-hand for '--create-reflog' and warns about the     future repurposing of the it when it is used.

  - The userdiff pattern for .php has been updated.

  - The content-transfer-encoding of the message 'git     send-email' sends out by default was 8bit, which can     cause trouble when there is an overlong line to bust RFC     5322/2822 limit. A new option 'auto' to automatically     switch to quoted-printable when there is such a line in     the payload has been introduced and is made the default.

  - 'git checkout' and 'git worktree add' learned to honor     checkout.defaultRemote when auto-vivifying a local     branch out of a remote tracking branch in a repository     with multiple remotes that have tracking branches that     share the same names. (merge 8d7b558bae     ab/checkout-default-remote later to maint).

  - 'git grep' learned the '--only-matching' option.

  - 'git rebase --rebase-merges' mode now handles octopus     merges as well.

  - Add a server-side knob to skip commits in     exponential/fibbonacci stride in an attempt to cover     wider swath of history with a smaller number of     iterations, potentially accepting a larger packfile     transfer, instead of going back one commit a time during     common ancestor discovery during the 'git fetch'     transaction. (merge 42cc7485a2     jt/fetch-negotiator-skipping later to maint).

  - A new configuration variable core.usereplacerefs has     been added, primarily to help server installations that     want to ignore the replace mechanism altogether.

  - Teach 'git tag -s' etc. a few configuration variables     (gpg.format that can be set to 'openpgp' or 'x509', and     gpg.<format>.program that is used to specify what     program to use to deal with the format) to allow x.509     certs with CMS via 'gpgsm' to be used instead of openpgp     via 'gnupg'.

  - Many more strings are prepared for l10n.

  - 'git p4 submit' learns to ask its own pre-submit hook if     it should continue with submitting.

  - The test performed at the receiving end of 'git push' to     prevent bad objects from entering repository can be     customized via receive.fsck.* configuration variables;
    we now have gained a counterpart to do the same on the     'git fetch' side, with fetch.fsck.* configuration     variables.

  - 'git pull --rebase=interactive' learned 'i' as a     short-hand for 'interactive'.

  - 'git instaweb' has been adjusted to run better with     newer Apache on RedHat based distros.

  - 'git range-diff' is a reimplementation of 'git tbdiff'     that lets us compare individual patches in two     iterations of a topic.

  - The sideband code learned to optionally paint selected     keywords at the beginning of incoming lines on the     receiving end.

  - 'git branch --list' learned to take the default sort     order from the 'branch.sort' configuration variable,     just like 'git tag --list' pays attention to 'tag.sort'.

  - 'git worktree' command learned '--quiet' option to make     it less verbose.

git 2.18.0 :

  - improvements to rename detection logic

  - When built with more recent cURL, GIT_SSL_VERSION can     now specify 'tlsv1.3' as its value.

  - 'git mergetools' learned talking to guiffy.

  - various other workflow improvements and fixes

  - performance improvements and other developer visible     fixes

git 2.17.1

  - Submodule 'names' come from the untrusted .gitmodules     file, but we blindly append them to $GIT_DIR/modules to     create our on-disk repo paths. This means you can do bad     things by putting '../' into the name. We now enforce     some rules for submodule names which will cause Git to     ignore these malicious names (CVE-2018-11235,     bsc#1095219)

  - It was possible to trick the code that sanity-checks     paths on NTFS into reading random piece of memory     (CVE-2018-11233, bsc#1095218)

  - Support on the server side to reject pushes to     repositories that attempt to create such problematic     .gitmodules file etc. as tracked contents, to help     hosting sites protect their customers by preventing     malicious contents from spreading.

git 2.17.0 :

  - 'diff' family of commands learned     '--find-object=<object-id>' option to limit the findings     to changes that involve the named object.

  - 'git format-patch' learned to give 72-cols to diffstat,     which is consistent with other line length limits the     subcommand uses for its output meant for e-mails.

  - The log from 'git daemon' can be redirected with a new     option; one relevant use case is to send the log to     standard error (instead of syslog) when running it from     inetd.

  - 'git rebase' learned to take '--allow-empty-message'     option.

  - 'git am' has learned the '--quit' option, in addition to     the existing '--abort' option; having the pair mirrors a     few other commands like 'rebase' and 'cherry-pick'.

  - 'git worktree add' learned to run the post-checkout     hook, just like 'git clone' runs it upon the initial     checkout.

  - 'git tag' learned an explicit '--edit' option that     allows the message given via '-m' and '-F' to be further     edited.

  - 'git fetch --prune-tags' may be used as a handy     short-hand for getting rid of stale tags that are     locally held.

  - The new '--show-current-patch' option gives an end-user     facing way to get the diff being applied when 'git     rebase' (and 'git am') stops with a conflict.

  - 'git add -p' used to offer '/' (look for a matching     hunk) as a choice, even there was only one hunk, which     has been corrected. Also the single-key help is now     given only for keys that are enabled (e.g. help for '/'     won't be shown when there is only one hunk).

  - Since Git 1.7.9, 'git merge' defaulted to --no-ff (i.e.
    even when the side branch being merged is a descendant     of the current commit, create a merge commit instead of     fast-forwarding) when merging a tag object. This was     appropriate default for integrators who pull signed tags     from their downstream contributors, but caused an     unnecessary merges when used by downstream contributors     who habitually 'catch up' their topic branches with     tagged releases from the upstream. Update 'git merge' to     default to --no-ff only when merging a tag object that     does *not* sit at its usual place in refs/tags/     hierarchy, and allow fast-forwarding otherwise, to     mitigate the problem.

  - 'git status' can spend a lot of cycles to compute the     relation between the current branch and its upstream,     which can now be disabled with '--no-ahead-behind'     option.

  - 'git diff' and friends learned funcname patterns for Go     language source files.

  - 'git send-email' learned '--reply-to=<address>' option.

  - Funcname pattern used for C# now recognizes 'async'     keyword.

  - In a way similar to how 'git tag' learned to honor the     pager setting only in the list mode, 'git config'     learned to ignore the pager setting when it is used for     setting values (i.e. when the purpose of the operation     is not to 'show').

This update was imported from the SUSE:SLE-15:Update update project.

This update for git fixes the following issues :

Security issues fixed :

CVE-2020-11008: Specially crafted URLs may have tricked the credentials helper to providing credential information that is not appropriate for the protocol in use and host being contacted (bsc#1169936)

git was updated to 2.26.1 (bsc#1169786, jsc#ECO-1628, bsc#1149792)

Fix git-daemon not starting after conversion from sysvinit to systemd service (bsc#1169605).

CVE-2020-5260: Specially crafted URLs with newline characters could have been used to make the Git client to send credential information for a wrong host to the attacker's site bsc#1168930

git 2.26.0 (bsc#1167890, jsc#SLE-11608) :

'git rebase' now uses a different backend that is based on the 'merge' machinery by default. The 'rebase.backend' configuration variable reverts to old behaviour when set to 'apply'

Improved handling of sparse checkouts

Improvements to many commands and internal features

git 2.25.2 :

bug fixes to various subcommands in specific operations

git 2.25.1 :

'git commit' now honors advise.statusHints

various updates, bug fixes and documentation updates

git 2.25.0

The branch description ('git branch --edit-description') has been used to fill the body of the cover letters by the format-patch command;
this has been enhanced so that the subject can also be filled.

A few commands learned to take the pathspec from the standard input or a named file, instead of taking it as the command line arguments, with the '--pathspec-from-file' option.

Test updates to prepare for SHA-2 transition continues.

Redo 'git name-rev' to avoid recursive calls.

When all files from some subdirectory were renamed to the root directory, the directory rename heuristics would fail to detect that as a rename/merge of the subdirectory to the root directory, which has been corrected.

HTTP transport had possible allocator/deallocator mismatch, which has been corrected.

git 2.24.1 :

CVE-2019-1348: The --export-marks option of fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths (bsc#1158785)

CVE-2019-1349: on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787)

CVE-2019-1350: Incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs (bsc#1158788)

CVE-2019-1351: on Windows mistakes drive letters outside of the US-English alphabet as relative paths (bsc#1158789)

CVE-2019-1352: on Windows was unaware of NTFS Alternate Data Streams (bsc#1158790)

CVE-2019-1353: when run in the Windows Subsystem for Linux while accessing a working directory on a regular Windows drive, none of the NTFS protections were active (bsc#1158791)

CVE-2019-1354: on Windows refuses to write tracked files with filenames that contain backslashes (bsc#1158792)

CVE-2019-1387: Recursive clones vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793)

CVE-2019-19604: a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795)

git 2.24.0

The command line parser learned '--end-of-options' notation.

A mechanism to affect the default setting for a (related) group of configuration variables is introduced.

'git fetch' learned '--set-upstream' option to help those who first clone from their private fork they intend to push to, add the true upstream via 'git remote add' and then 'git fetch' from it.

fixes and improvements to UI, workflow and features, bash completion fixes

git 2.23.0 :

The '--base' option of 'format-patch' computed the patch-ids for prerequisite patches in an unstable way, which has been updated to compute in a way that is compatible with 'git patch-id

--stable'.

The 'git log' command by default behaves as if the --mailmap option was given.

fixes and improvements to UI, workflow and features

git 2.22.1

A relative pathname given to 'git init --template=<path> <repo>' ought to be relative to the directory 'git init' gets invoked in, but it instead was made relative to the repository, which has been corrected.
</repo></path>

'git worktree add' used to fail when another worktree connected to the same repository was corrupt, which has been corrected.

'git am -i --resolved' segfaulted after trying to see a commit as if it were a tree, which has been corrected.

'git merge --squash' is designed to update the working tree and the index without creating the commit, and this cannot be countermanded by adding the '--commit' option; the command now refuses to work when both options are given.

Update to Unicode 12.1 width table.

'git request-pull' learned to warn when the ref we ask them to pull from in the local repository and in the published repository are different.

'git fetch' into a lazy clone forgot to fetch base objects that are necessary to complete delta in a thin packfile, which has been corrected.

The URL decoding code has been updated to avoid going past the end of the string while parsing %-<hex>-<hex> sequence. </hex></hex>

'git clean' silently skipped a path when it cannot lstat() it; now it gives a warning.

'git rm' to resolve a conflicted path leaked an internal message 'needs merge' before actually removing the path, which was confusing.
This has been corrected.

Many more bugfixes and code cleanups.

removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by firewalld.

partial fix for git instaweb giving 500 error (bsc#1112230)

git 2.22.0

The filter specification '--filter=sparse:path=<path>' used to create a lazy/partial clone has been removed. Using a blob that is part of the project as sparse specification is still supported with the '--filter=sparse:oid=<blob>' option </blob></path>

'git checkout --no-overlay' can be used to trigger a new mode of checking out paths out of the tree-ish, that allows paths that match the pathspec that are in the current index and working tree and are not in the tree-ish.

Four new configuration variables {author,committer}.{name,email} have been introduced to override user.{name,email} in more specific cases.

'git branch' learned a new subcommand '--show-current'.

The command line completion (in contrib/) has been taught to complete more subcommand parameters.

The completion helper code now pays attention to repository-local configuration (when available), which allows --list-cmds to honour a repository specific setting of completion.commands, for example.

The list of conflicted paths shown in the editor while concluding a conflicted merge was shown above the scissors line when the clean-up mode is set to 'scissors', even though it was commented out just like the list of updated paths and other information to help the user explain the merge better.

'git rebase' that was reimplemented in C did not set ORIG_HEAD correctly, which has been corrected.

'git worktree add' used to do a 'find an available name with stat and then mkdir', which is race-prone. This has been fixed by using mkdir and reacting to EEXIST in a loop.

Move to DocBook 5.x. Asciidoctor 2.x no longer supports the legacy DocBook 4.5 format.

update git-web AppArmor profile for bash and tar usrMerge (bsc#1132350)

git 2.21.0

Historically, the '-m' (mainline) option can only be used for 'git cherry-pick' and 'git revert' when working with a merge commit. This version of Git no longer warns or errors out when working with a single-parent commit, as long as the argument to the '-m' option is 1 (i.e. it has only one parent, and the request is to pick or revert relative to that first parent). Scripts that relied on the behaviour may get broken with this change.

Small fixes and features for fast-export and fast-import.

The 'http.version' configuration variable can be used with recent enough versions of cURL library to force the version of HTTP used to talk when fetching and pushing.

'git push $there $src:$dst' rejects when $dst is not a fully qualified refname and it is not clear what the end user meant.

Update 'git multimail' from the upstream.

A new date format '--date=human' that morphs its output depending on how far the time is from the current time has been introduced.
'--date=auto:human' can be used to use this new format (or any existing format) when the output is going to the pager or to the terminal, and otherwise the default format.

Fix worktree creation race (bsc#1114225).

add shadow build dependency to the -daemon subpackage.

git 2.20.1 :

portability fixes

'git help -a' did not work well when an overly long alias was defined

no longer squelched an error message when the run_command API failed to run a missing command

git 2.20.0

'git help -a' now gives verbose output (same as 'git help -av'). Those who want the old output may say 'git help --no-verbose -a'..

'git send-email' learned to grab address-looking string on any trailer whose name ends with '-by'.

'git format-patch' learned new '--interdiff' and '--range-diff' options to explain the difference between this version and the previous attempt in the cover letter (or after the three-dashes as a comment).

Developer builds now use -Wunused-function compilation option.

Fix a bug in which the same path could be registered under multiple worktree entries if the path was missing (for instance, was removed manually). Also, as a convenience, expand the number of cases in which

--force is applicable.

The overly large Documentation/config.txt file have been split into million little pieces. This potentially allows each individual piece to be included into the manual page of the command it affects more easily.

Malformed or crafted data in packstream can make our code attempt to read or write past the allocated buffer and abort, instead of reporting an error, which has been fixed.

Fix for a long-standing bug that leaves the index file corrupt when it shrinks during a partial commit.

'git merge' and 'git pull' that merges into an unborn branch used to completely ignore '--verify-signatures', which has been corrected.

...and much more features and fixes

git 2.19.2 :

various bug fixes for multiple subcommands and operations

git 2.19.1 :

CVE-2018-17456: Specially crafted .gitmodules files may have allowed arbitrary code execution when the repository is cloned with

--recurse-submodules (bsc#1110949)

git 2.19.0 :

'git diff' compares the index and the working tree. For paths added with intent-to-add bit, the command shows the full contents of them as added, but the paths themselves were not marked as new files. They are now shown as new by default.

'git apply' learned the '--intent-to-add' option so that an otherwise working-tree-only application of a patch will add new paths to the index marked with the 'intent-to-add' bit.

'git grep' learned the '--column' option that gives not just the line number but the column number of the hit.

The '-l' option in 'git branch -l' is an unfortunate short-hand for '--create-reflog', but many users, both old and new, somehow expect it to be something else, perhaps '--list'. This step warns when '-l' is used as a short-hand for '--create-reflog' and warns about the future repurposing of the it when it is used.

The userdiff pattern for .php has been updated.

The content-transfer-encoding of the message 'git send-email' sends out by default was 8bit, which can cause trouble when there is an overlong line to bust RFC 5322/2822 limit. A new option 'auto' to automatically switch to quoted-printable when there is such a line in the payload has been introduced and is made the default.

'git checkout' and 'git worktree add' learned to honor checkout.defaultRemote when auto-vivifying a local branch out of a remote tracking branch in a repository with multiple remotes that have tracking branches that share the same names. (merge 8d7b558bae ab/checkout-default-remote later to maint).

'git grep' learned the '--only-matching' option.

'git rebase --rebase-merges' mode now handles octopus merges as well.

Add a server-side knob to skip commits in exponential/fibbonacci stride in an attempt to cover wider swath of history with a smaller number of iterations, potentially accepting a larger packfile transfer, instead of going back one commit a time during common ancestor discovery during the 'git fetch' transaction. (merge 42cc7485a2 jt/fetch-negotiator-skipping later to maint).

A new configuration variable core.usereplacerefs has been added, primarily to help server installations that want to ignore the replace mechanism altogether.

Teach 'git tag -s' etc. a few configuration variables (gpg.format that can be set to 'openpgp' or 'x509', and gpg.<format>.program that is used to specify what program to use to deal with the format) to allow x.509 certs with CMS via 'gpgsm' to be used instead of openpgp via 'gnupg'. </format>

Many more strings are prepared for l10n.

'git p4 submit' learns to ask its own pre-submit hook if it should continue with submitting.

The test performed at the receiving end of 'git push' to prevent bad objects from entering repository can be customized via receive.fsck.* configuration variables; we now have gained a counterpart to do the same on the 'git fetch' side, with fetch.fsck.* configuration variables.

'git pull --rebase=interactive' learned 'i' as a short-hand for 'interactive'.

'git instaweb' has been adjusted to run better with newer Apache on RedHat based distros.

'git range-diff' is a reimplementation of 'git tbdiff' that lets us compare individual patches in two iterations of a topic.

The sideband code learned to optionally paint selected keywords at the beginning of incoming lines on the receiving end.

'git branch --list' learned to take the default sort order from the 'branch.sort' configuration variable, just like 'git tag --list' pays attention to 'tag.sort'.

'git worktree' command learned '--quiet' option to make it less verbose.

git 2.18.0 :

improvements to rename detection logic

When built with more recent cURL, GIT_SSL_VERSION can now specify 'tlsv1.3' as its value.

'git mergetools' learned talking to guiffy.

various other workflow improvements and fixes

performance improvements and other developer visible fixes

git 2.17.1

Submodule 'names' come from the untrusted .gitmodules file, but we blindly append them to $GIT_DIR/modules to create our on-disk repo paths. This means you can do bad things by putting '../' into the name. We now enforce some rules for submodule names which will cause Git to ignore these malicious names (CVE-2018-11235, bsc#1095219)

It was possible to trick the code that sanity-checks paths on NTFS into reading random piece of memory (CVE-2018-11233, bsc#1095218)

Support on the server side to reject pushes to repositories that attempt to create such problematic .gitmodules file etc. as tracked contents, to help hosting sites protect their customers by preventing malicious contents from spreading.

git 2.17.0 :

'diff' family of commands learned '--find-object=<object-id>' option to limit the findings to changes that involve the named object.
</object-id>

'git format-patch' learned to give 72-cols to diffstat, which is consistent with other line length limits the subcommand uses for its output meant for e-mails.

The log from 'git daemon' can be redirected with a new option; one relevant use case is to send the log to standard error (instead of syslog) when running it from inetd.

'git rebase' learned to take '--allow-empty-message' option.

'git am' has learned the '--quit' option, in addition to the existing '--abort' option; having the pair mirrors a few other commands like 'rebase' and 'cherry-pick'.

'git worktree add' learned to run the post-checkout hook, just like 'git clone' runs it upon the initial checkout.

'git tag' learned an explicit '--edit' option that allows the message given via '-m' and '-F' to be further edited.

'git fetch --prune-tags' may be used as a handy short-hand for getting rid of stale tags that are locally held.

The new '--show-current-patch' option gives an end-user facing way to get the diff being applied when 'git rebase' (and 'git am') stops with a conflict.

'git add -p' used to offer '/' (look for a matching hunk) as a choice, even there was only one hunk, which has been corrected. Also the single-key help is now given only for keys that are enabled (e.g. help for '/' won't be shown when there is only one hunk).

Since Git 1.7.9, 'git merge' defaulted to --no-ff (i.e. even when the side branch being merged is a descendant of the current commit, create a merge commit instead of fast-forwarding) when merging a tag object.
This was appropriate default for integrators who pull signed tags from their downstream contributors, but caused an unnecessary merges when used by downstream contributors who habitually 'catch up' their topic branches with tagged releases from the upstream. Update 'git merge' to default to --no-ff only when merging a tag object that does *not* sit at its usual place in refs/tags/ hierarchy, and allow fast-forwarding otherwise, to mitigate the problem.

'git status' can spend a lot of cycles to compute the relation between the current branch and its upstream, which can now be disabled with '--no-ahead-behind' option.

'git diff' and friends learned funcname patterns for Go language source files.

'git send-email' learned '--reply-to=<address>' option. </address>

Funcname pattern used for C# now recognizes 'async' keyword.

In a way similar to how 'git tag' learned to honor the pager setting only in the list mode, 'git config' learned to ignore the pager setting when it is used for setting values (i.e. when the purpose of the operation is not to 'show').

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for fixes the following security issues :

  - path sanity-checks on NTFS can read arbitrary memory     (CVE-2018-11233, boo#1095218)

  - arbitrary code execution when recursively cloning a     malicious repository (CVE-2018-11235, boo#1095219)

An update of the git package has been released.

Upstream security fixes related to .gitmodules handling. From the [upstream announcement](https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct .c.googlers.com/) :

```

  - Submodule 'names' come from the untrusted .gitmodules     file, but we blindly append them to $GIT_DIR/modules to     create our on-disk repo paths. This means you can do bad     things by putting '../' into the name. We now enforce     some rules for submodule names which will cause Git to     ignore these malicious names (CVE-2018-11235).

    Credit for finding this vulnerability and the proof of     concept from which the test script was adapted goes to     Etienne Stalmans.

  - It was possible to trick the code that sanity-checks     paths on NTFS into reading random piece of memory     (CVE-2018-11233). ```

A preliminary patch to resolve an issue with zlib on aarch64 is also included (RHBZ#1582555).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git to version 2.16.4 fixes several issues. These security issues were fixed :

  - CVE-2018-11233: Path sanity-checks on NTFS allowed     attackers to read arbitrary memory (bsc#1095218)

  - CVE-2018-11235: Arbitrary code execution when     recursively cloning a malicious repository (bsc#1095219)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for git fixes several issues.

These security issues were fixed :

CVE-2018-11233: Path sanity-checks on NTFS allowed attackers to read arbitrary memory (bsc#1095218)

CVE-2018-11235: Arbitrary code execution when recursively cloning a malicious repository (bsc#1095219)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.(CVE-2018-11233)

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs 'git clone
--recurse-submodules' because submodule 'names' are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with '../' in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.(CVE-2018-11235)

This update for git fixes several issues. These security issues were fixed :

  - CVE-2018-11233: Path sanity-checks on NTFS allowed     attackers to read arbitrary memory (bsc#1095218)

  - CVE-2018-11235: Arbitrary code execution when     recursively cloning a malicious repository (bsc#1095219)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3671-1 advisory.

    Etienne Stalmans discovered that git did not properly validate git submodules files. A remote attacker     could possibly use this to craft a git repo that causes arbitrary code execution when git clone
    --recurse-submodules is used. (CVE-2018-11235)

    It was discovered that an integer overflow existed in git's pathname

    consistency checking code when used on NTFS filesystems. An attacker could use this to cause a denial of     service or expose sensitive information. (CVE-2018-11233)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New git packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The Git community reports :

- In affected versions of Git, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

- In affected versions of Git, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs 'git clone --recurse-submodules' because submodule 'names' are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with '../' in a name.
Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Upstream security fixes related to .gitmodules handling. From the [upstream announcement](https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct .c.googlers.com/) :

```

  - Submodule 'names' come from the untrusted .gitmodules     file, but we blindly append them to $GIT_DIR/modules to     create our on-disk repo paths. This means you can do bad     things by putting '../' into the name. We now enforce     some rules for submodule names which will cause Git to     ignore these malicious names (CVE-2018-11235).

    Credit for finding this vulnerability and the proof of     concept from which the test script was adapted goes to     Etienne Stalmans.

  - It was possible to trick the code that sanity-checks     paths on NTFS into reading random piece of memory     (CVE-2018-11233). ```

Also fix a segfault in rev-parse with invalid input (#1581678) and install contrib/diff-highlight (#1550251).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Git for Windows installed on the remote host is 2.13.x   prior to 2.13.7, 2.14.x prior to 2.14.4, 2.15.x prior to 2.15.2,   2.16.x prior to 2.16.4 or 2.17.x prior to 2.17.1. It is,   therefore, affected by a remote code execution vulnerability.

The remote host is affected by the vulnerability described in GLSA-201805-13 (Git: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Git. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code on both client and server.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
194012	RHEL 6 / 7 : rh-git29-git (RHSA-2018:2147)	Nessus	Red Hat Local Security Checks	high
136311	openSUSE Security Update : git (openSUSE-2020-598)	Nessus	SuSE Local Security Checks	critical
136074	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2020:1121-1)	Nessus	SuSE Local Security Checks	critical
135580	SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)	Nessus	SuSE Local Security Checks	critical
123178	openSUSE Security Update : git (openSUSE-2019-410)	Nessus	SuSE Local Security Checks	high
121953	Photon OS 2.0: Git PHSA-2018-2.0-0053	Nessus	PhotonOS Local Security Checks	high
121844	Photon OS 1.0: Git PHSA-2018-1.0-0145	Nessus	PhotonOS Local Security Checks	high
120535	Fedora 28 : git (2018-75f7624a9f)	Nessus	Fedora Local Security Checks	high
120026	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2018:1872-1)	Nessus	SuSE Local Security Checks	high
118260	SUSE SLES12 Security Update : git (SUSE-SU-2018:1566-2)	Nessus	SuSE Local Security Checks	high
110458	Amazon Linux AMI : git (ALAS-2018-1035)	Nessus	Amazon Linux Local Security Checks	high
110452	Amazon Linux 2 : git (ALAS-2018-1035)	Nessus	Amazon Linux Local Security Checks	high
110411	SUSE SLES12 Security Update : git (SUSE-SU-2018:1566-1)	Nessus	SuSE Local Security Checks	high
110395	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-3671-1)	Nessus	Ubuntu Local Security Checks	high
110335	openSUSE Security Update : git (openSUSE-2018-557)	Nessus	SuSE Local Security Checks	high
110308	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : git (SSA:2018-152-01)	Nessus	Slackware Local Security Checks	high
110304	FreeBSD : Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235) (c7a135f4-66a4-11e8-9e63-3085a9a47796)	Nessus	FreeBSD Local Security Checks	high
110299	Fedora 27 : git (2018-080a3d7866)	Nessus	Fedora Local Security Checks	high
110270	Git for Windows 2.13.x < 2.13.7 / 2.14.x < 2.14.4 / 2.15.x < 2.15.2 / 2.16.x < 2.16.4 / 2.17.x < 2.17.1 Remote Code Execution	Nessus	Windows	high
110212	GLSA-201805-13 : Git: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2018-11233

high

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high