From 7f5dd143acb69b8ee87a1b36c4b0e3cd1e08cafe Mon Sep 17 00:00:00 2001 From: Taylor Blau Date: Tue, 8 Jul 2025 14:47:50 -0400 Subject: Documentation/RelNotes: use .adoc extension for new security releases When preparing the latest round of security fixes, we wrote release notes in v2.43.7, and then successively merged those up through to the various 'maint' branches. However, the 2.49 release series is the first to have commit 1f010d6bdf (doc: use .adoc extension for AsciiDoc files, 2025-01-20). This means that we should have renamed the new-but-historical release notes from *.txt to *.adoc during the merge into the 'maint-2.49' branch, but neglected to do so. Rename them accordingly to match the convention introduced by 1f010d6bdf. Since the release materials in question here were prepared before v2.50.0 was tagged, the 'maint' track for that release series is OK as is. Signed-off-by: Taylor Blau Signed-off-by: Junio C Hamano --- Documentation/RelNotes/2.43.7.adoc | 73 ++++++++++++++++++++++++++++++++++++++ Documentation/RelNotes/2.43.7.txt | 73 -------------------------------------- Documentation/RelNotes/2.44.4.adoc | 7 ++++ Documentation/RelNotes/2.44.4.txt | 7 ---- Documentation/RelNotes/2.45.4.adoc | 7 ++++ Documentation/RelNotes/2.45.4.txt | 7 ---- Documentation/RelNotes/2.46.4.adoc | 7 ++++ Documentation/RelNotes/2.46.4.txt | 7 ---- Documentation/RelNotes/2.47.3.adoc | 8 +++++ Documentation/RelNotes/2.47.3.txt | 8 ----- Documentation/RelNotes/2.48.2.adoc | 8 +++++ Documentation/RelNotes/2.48.2.txt | 8 ----- Documentation/RelNotes/2.49.1.adoc | 12 +++++++ Documentation/RelNotes/2.49.1.txt | 12 ------- 14 files changed, 122 insertions(+), 122 deletions(-) create mode 100644 Documentation/RelNotes/2.43.7.adoc delete mode 100644 Documentation/RelNotes/2.43.7.txt create mode 100644 Documentation/RelNotes/2.44.4.adoc delete mode 100644 Documentation/RelNotes/2.44.4.txt create mode 100644 Documentation/RelNotes/2.45.4.adoc delete mode 100644 Documentation/RelNotes/2.45.4.txt create mode 100644 Documentation/RelNotes/2.46.4.adoc delete mode 100644 Documentation/RelNotes/2.46.4.txt create mode 100644 Documentation/RelNotes/2.47.3.adoc delete mode 100644 Documentation/RelNotes/2.47.3.txt create mode 100644 Documentation/RelNotes/2.48.2.adoc delete mode 100644 Documentation/RelNotes/2.48.2.txt create mode 100644 Documentation/RelNotes/2.49.1.adoc delete mode 100644 Documentation/RelNotes/2.49.1.txt (limited to 'Documentation/RelNotes') diff --git a/Documentation/RelNotes/2.43.7.adoc b/Documentation/RelNotes/2.43.7.adoc new file mode 100644 index 0000000000..95702a036e --- /dev/null +++ b/Documentation/RelNotes/2.43.7.adoc @@ -0,0 +1,73 @@ +Git v2.43.7 Release Notes +========================= + +This release includes fixes for CVE-2025-27613, CVE-2025-27614, +CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and +CVE-2025-48386. + +Fixes since v2.43.6 +------------------- + + * CVE-2025-27613, Gitk: + + When a user clones an untrusted repository and runs Gitk without + additional command arguments, any writable file can be created and + truncated. The option "Support per-file encoding" must have been + enabled. The operation "Show origin of this line" is affected as + well, regardless of the option being enabled or not. + + * CVE-2025-27614, Gitk: + + A Git repository can be crafted in such a way that a user who has + cloned the repository can be tricked into running any script + supplied by the attacker by invoking `gitk filename`, where + `filename` has a particular structure. + + * CVE-2025-46334, Git GUI (Windows only): + + A malicious repository can ship versions of sh.exe or typical + textconv filter programs such as astextplain. On Windows, path + lookup can find such executables in the worktree. These programs + are invoked when the user selects "Git Bash" or "Browse Files" from + the menu. + + * CVE-2025-46835, Git GUI: + + When a user clones an untrusted repository and is tricked into + editing a file located in a maliciously named directory in the + repository, then Git GUI can create and overwrite any writable + file. + + * CVE-2025-48384, Git: + + When reading a config value, Git strips any trailing carriage + return and line feed (CRLF). When writing a config entry, values + with a trailing CR are not quoted, causing the CR to be lost when + the config is later read. When initializing a submodule, if the + submodule path contains a trailing CR, the altered path is read + resulting in the submodule being checked out to an incorrect + location. If a symlink exists that points the altered path to the + submodule hooks directory, and the submodule contains an executable + post-checkout hook, the script may be unintentionally executed + after checkout. + + * CVE-2025-48385, Git: + + When cloning a repository Git knows to optionally fetch a bundle + advertised by the remote server, which allows the server-side to + offload parts of the clone to a CDN. The Git client does not + perform sufficient validation of the advertised bundles, which + allows the remote side to perform protocol injection. + + This protocol injection can cause the client to write the fetched + bundle to a location controlled by the adversary. The fetched + content is fully controlled by the server, which can in the worst + case lead to arbitrary code execution. + + * CVE-2025-48386, Git: + + The wincred credential helper uses a static buffer (`target`) as a + unique key for storing and comparing against internal storage. This + credential helper does not properly bounds check the available + space remaining in the buffer before appending to it with + `wcsncat()`, leading to potential buffer overflows. diff --git a/Documentation/RelNotes/2.43.7.txt b/Documentation/RelNotes/2.43.7.txt deleted file mode 100644 index 95702a036e..0000000000 --- a/Documentation/RelNotes/2.43.7.txt +++ /dev/null @@ -1,73 +0,0 @@ -Git v2.43.7 Release Notes -========================= - -This release includes fixes for CVE-2025-27613, CVE-2025-27614, -CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and -CVE-2025-48386. - -Fixes since v2.43.6 -------------------- - - * CVE-2025-27613, Gitk: - - When a user clones an untrusted repository and runs Gitk without - additional command arguments, any writable file can be created and - truncated. The option "Support per-file encoding" must have been - enabled. The operation "Show origin of this line" is affected as - well, regardless of the option being enabled or not. - - * CVE-2025-27614, Gitk: - - A Git repository can be crafted in such a way that a user who has - cloned the repository can be tricked into running any script - supplied by the attacker by invoking `gitk filename`, where - `filename` has a particular structure. - - * CVE-2025-46334, Git GUI (Windows only): - - A malicious repository can ship versions of sh.exe or typical - textconv filter programs such as astextplain. On Windows, path - lookup can find such executables in the worktree. These programs - are invoked when the user selects "Git Bash" or "Browse Files" from - the menu. - - * CVE-2025-46835, Git GUI: - - When a user clones an untrusted repository and is tricked into - editing a file located in a maliciously named directory in the - repository, then Git GUI can create and overwrite any writable - file. - - * CVE-2025-48384, Git: - - When reading a config value, Git strips any trailing carriage - return and line feed (CRLF). When writing a config entry, values - with a trailing CR are not quoted, causing the CR to be lost when - the config is later read. When initializing a submodule, if the - submodule path contains a trailing CR, the altered path is read - resulting in the submodule being checked out to an incorrect - location. If a symlink exists that points the altered path to the - submodule hooks directory, and the submodule contains an executable - post-checkout hook, the script may be unintentionally executed - after checkout. - - * CVE-2025-48385, Git: - - When cloning a repository Git knows to optionally fetch a bundle - advertised by the remote server, which allows the server-side to - offload parts of the clone to a CDN. The Git client does not - perform sufficient validation of the advertised bundles, which - allows the remote side to perform protocol injection. - - This protocol injection can cause the client to write the fetched - bundle to a location controlled by the adversary. The fetched - content is fully controlled by the server, which can in the worst - case lead to arbitrary code execution. - - * CVE-2025-48386, Git: - - The wincred credential helper uses a static buffer (`target`) as a - unique key for storing and comparing against internal storage. This - credential helper does not properly bounds check the available - space remaining in the buffer before appending to it with - `wcsncat()`, leading to potential buffer overflows. diff --git a/Documentation/RelNotes/2.44.4.adoc b/Documentation/RelNotes/2.44.4.adoc new file mode 100644 index 0000000000..8db4d5b537 --- /dev/null +++ b/Documentation/RelNotes/2.44.4.adoc @@ -0,0 +1,7 @@ +Git v2.44.4 Release Notes +========================= + +This release merges up the fixes that appears in v2.43.7 to address +the following CVEs: CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, +CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. +See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.44.4.txt b/Documentation/RelNotes/2.44.4.txt deleted file mode 100644 index 8db4d5b537..0000000000 --- a/Documentation/RelNotes/2.44.4.txt +++ /dev/null @@ -1,7 +0,0 @@ -Git v2.44.4 Release Notes -========================= - -This release merges up the fixes that appears in v2.43.7 to address -the following CVEs: CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, -CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. -See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.45.4.adoc b/Documentation/RelNotes/2.45.4.adoc new file mode 100644 index 0000000000..5b50d8daf0 --- /dev/null +++ b/Documentation/RelNotes/2.45.4.adoc @@ -0,0 +1,7 @@ +Git v2.45.4 Release Notes +========================= + +This release merges up the fixes that appears in v2.43.7, and v2.44.4 +to address the following CVEs: CVE-2025-27613, CVE-2025-27614, +CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and +CVE-2025-48386. See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.45.4.txt b/Documentation/RelNotes/2.45.4.txt deleted file mode 100644 index 5b50d8daf0..0000000000 --- a/Documentation/RelNotes/2.45.4.txt +++ /dev/null @@ -1,7 +0,0 @@ -Git v2.45.4 Release Notes -========================= - -This release merges up the fixes that appears in v2.43.7, and v2.44.4 -to address the following CVEs: CVE-2025-27613, CVE-2025-27614, -CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and -CVE-2025-48386. See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.46.4.adoc b/Documentation/RelNotes/2.46.4.adoc new file mode 100644 index 0000000000..622f4c752f --- /dev/null +++ b/Documentation/RelNotes/2.46.4.adoc @@ -0,0 +1,7 @@ +Git v2.46.4 Release Notes +========================= + +This release merges up the fixes that appears in v2.43.7, v2.44.4, and +v2.45.4 to address the following CVEs: CVE-2025-27613, CVE-2025-27614, +CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and +CVE-2025-48386. See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.46.4.txt b/Documentation/RelNotes/2.46.4.txt deleted file mode 100644 index 622f4c752f..0000000000 --- a/Documentation/RelNotes/2.46.4.txt +++ /dev/null @@ -1,7 +0,0 @@ -Git v2.46.4 Release Notes -========================= - -This release merges up the fixes that appears in v2.43.7, v2.44.4, and -v2.45.4 to address the following CVEs: CVE-2025-27613, CVE-2025-27614, -CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and -CVE-2025-48386. See the release notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.47.3.adoc b/Documentation/RelNotes/2.47.3.adoc new file mode 100644 index 0000000000..bc2a2b833b --- /dev/null +++ b/Documentation/RelNotes/2.47.3.adoc @@ -0,0 +1,8 @@ +Git v2.47.3 Release Notes +========================= + +This release merges up the fixes that appears in v2.43.7, v2.44.4, +v2.45.4, and v2.46.4 to address the following CVEs: CVE-2025-27613, +CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, +CVE-2025-48385, and CVE-2025-48386. See the release notes for v2.43.7 +for details. diff --git a/Documentation/RelNotes/2.47.3.txt b/Documentation/RelNotes/2.47.3.txt deleted file mode 100644 index bc2a2b833b..0000000000 --- a/Documentation/RelNotes/2.47.3.txt +++ /dev/null @@ -1,8 +0,0 @@ -Git v2.47.3 Release Notes -========================= - -This release merges up the fixes that appears in v2.43.7, v2.44.4, -v2.45.4, and v2.46.4 to address the following CVEs: CVE-2025-27613, -CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, -CVE-2025-48385, and CVE-2025-48386. See the release notes for v2.43.7 -for details. diff --git a/Documentation/RelNotes/2.48.2.adoc b/Documentation/RelNotes/2.48.2.adoc new file mode 100644 index 0000000000..f3f2f90c2b --- /dev/null +++ b/Documentation/RelNotes/2.48.2.adoc @@ -0,0 +1,8 @@ +Git v2.48.2 Release Notes +========================= + +This release merges up the fixes that appears in v2.43.7, v2.44.4, +v2.45.4, v2.46.4, and v2.47.3 to address the following CVEs: +CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, +CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release +notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.48.2.txt b/Documentation/RelNotes/2.48.2.txt deleted file mode 100644 index f3f2f90c2b..0000000000 --- a/Documentation/RelNotes/2.48.2.txt +++ /dev/null @@ -1,8 +0,0 @@ -Git v2.48.2 Release Notes -========================= - -This release merges up the fixes that appears in v2.43.7, v2.44.4, -v2.45.4, v2.46.4, and v2.47.3 to address the following CVEs: -CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, -CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release -notes for v2.43.7 for details. diff --git a/Documentation/RelNotes/2.49.1.adoc b/Documentation/RelNotes/2.49.1.adoc new file mode 100644 index 0000000000..c619e8b495 --- /dev/null +++ b/Documentation/RelNotes/2.49.1.adoc @@ -0,0 +1,12 @@ +Git v2.49.1 Release Notes +========================= + +This release merges up the fixes that appear in v2.43.7, v2.44.4, +v2.45.4, v2.46.4, v2.47.3, and v2.48.2 to address the following CVEs: +CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, +CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release +notes for v2.43.7 for details. + +It also contains some updates to various CI bits to work around +and/or to adjust to the deprecation of use of Ubuntu 20.04 GitHub +Actions CI, updates to to Fedora base image. diff --git a/Documentation/RelNotes/2.49.1.txt b/Documentation/RelNotes/2.49.1.txt deleted file mode 100644 index c619e8b495..0000000000 --- a/Documentation/RelNotes/2.49.1.txt +++ /dev/null @@ -1,12 +0,0 @@ -Git v2.49.1 Release Notes -========================= - -This release merges up the fixes that appear in v2.43.7, v2.44.4, -v2.45.4, v2.46.4, v2.47.3, and v2.48.2 to address the following CVEs: -CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, -CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release -notes for v2.43.7 for details. - -It also contains some updates to various CI bits to work around -and/or to adjust to the deprecation of use of Ubuntu 20.04 GitHub -Actions CI, updates to to Fedora base image. -- cgit v1.3