标签

Third preview for v2.24.0

MinGit for Windows v2.23.0(2)

Changes since Git for Windows v2.23.0 (August 17th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* The Azure Pipeline was adjusted for changes in Homebrew that are
  outside of Git's control.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

MinGit for Windows v2.22.0(2)

Changes since Git for Windows v2.22.0 (June 8th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* The Azure Pipeline was adjusted for changes in Homebrew that are
  outside of Git's control.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

MinGit for Windows v2.21.0(4)

Changes since MinGit v2.21.0(4) (August 17th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* The Azure Pipeline was adjusted for changes in Homebrew and Cygwin
  that are outside of Git's control.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

MinGit for Windows v2.19.2(4)

Changes since MinGit v2.19.2(3) (August 17th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* The Azure Pipeline now runs the Windows tests in parallel, to make
  validation of newer MinGit versions faster.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

Second preview for v2.24.0

MinGit v2.11.1 prerelease 6

Changes since MinGit v2.11.1 prerelease 5 (August 17th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* An Azure Pipelines build definition has been added.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

MinGit for Windows v2.14.4(5)

Changes since MinGit for Windows v2.14.4(5) (August 17th 2019)

Enhancements:

* There is only one system gitconfig now (no more
  `C:\ProgramData\Git\config`), and it is in the top-level `etc`
  directory.

* An Azure Pipelines build definition has been added.

Bug Fixes

* CVE-2019-1348:
  The --export-marks option of git fast-import is exposed also via the
  in-stream command feature export-marks=... and it allows overwriting
  arbitrary paths.

* CVE-2019-1349:
  When submodules are cloned recursively, under certain circumstances
  Git could be fooled into using the same Git directory twice. We now
  require the directory to be empty.

* CVE-2019-1350:
  Incorrect quoting of command-line arguments allowed remote code
  execution during a recursive clone in conjunction SSH URLs.

* CVE-2019-1351:
  While the only permitted drive letters for physical drives on Windows
  are letters of the US-English alphabet, this restriction does not
  apply to virtual drives assigned via subst <letter>: <path>. Git
  mistook such paths for relative paths, allowing writing outside of the
  worktree while cloning.

* CVE-2019-1352:
  Git was unaware of NTFS Alternate Data Streams, allowing files inside
  the .git/ directory to be overwritten during a clone.

* CVE-2019-1353:
  When running Git in WSL while accessing a working directory on a
  regular Windows drive, none of the NTFS protections were active.

* CVE-2019-1354:
  Filenames on Linux/Unix can contain backslashes. On Windows,
  backslashes are directory separators. Git did not use to refuse to
  write out tracked files with such filenames.

* CVE-2019-1387:
  Recursive clones are currently affected by a vulnerability that is
  caused by too-lax validation of submodule names, allowing very
  targeted attacks via remote code execution in recursive clones.

Early preview of Git for Windows v2.24.0.

MinGit for Windows v2.14.4(4)

Changes since MinGit v2.14.4(3) (August 13th 2019)

Bug Fixes

  * When C:\ProgramData\Git\config's ownership is validated before it is
    used, a non-existing file does not trigger a warning about dubious
    ownership any longer.

MinGit for Windows v2.21.0(3)

Changes since MinGit v2.21.0(2) (August 13th 2019)

Bug Fixes

  * When C:\ProgramData\Git\config's ownership is validated before it is
    used, a non-existing file does not trigger a warning about dubious
    ownership any longer.

MinGit for Windows v2.19.2(3)

Changes since MinGit v2.19.2(2) (August 13th 2019)

Bug Fixes

  * When C:\ProgramData\Git\config's ownership is validated before it is
    used, a non-existing file does not trigger a warning about dubious
    ownership any longer.

MinGit v2.11.1 prerelease 5

Changes since MinGit v2.11.1 prerelease 4 (August 13th 2019)

Bug Fixes

  * When C:\ProgramData\Git\config's ownership is validated before it is
    used, a non-existing file does not trigger a warning about dubious
    ownership any longer.

Git for Windows v2.23.0

Changes since Git for Windows v2.22.0 (June 8th 2019)

New Features

  * Comes with Git v2.23.0.
  * Comes with patch level 3 of the MSYS2 runtime (Git for Windows
    flavor) based on Cygwin 3.0.7.
  * Comes with PCRE2 v10.33.
  * Comes with GNU Privacy Guard v2.2.17.
  * Comes with cURL v7.65.3.
  * Comes with Git LFS v2.8.0.
  * When configuring Git for Windows to use plink, there is now a
    checkbox specifically for TortoisePlink.
  * The FSCache feature is now used with git checkout and git reset in
    sparse checkouts.

Bug Fixes

  * Git for Windows' MSYS2 runtime was patched to fix a bug where
    setting the environment variable SHELL to an empty string in a
    shell script would not only fail to pass that setting to non-MSYS2
    processes (such as git.exe) but also completely skip all
    environment variables that sort after said variable.
  * git clean -dfx no longer follows NTFS junction points (also known
    as mount points).
  * A workaround now allows cloning to certain network drives (e.g.
    Isilon).
  * Fixed CVE-2019-1211 in MinGit/Portable Git by being more careful
    about validating the Windows-wide config.

Third preview for v2.23.0

Second preview for v2.23.0

Early preview of Git for Windows v2.23.0.

MinGit for Windows v2.19.2(2)

Changes since MinGit v2.19.2 (November 21st 2018)

Bug Fixes

  * `git version --build-options` now reports the correct architecture
    for 32-bit builds again.
  * Git can now access `git://` remotes again.
  * C:\ProgramData\Git\config's ownership is validated before it is used

MinGit for Windows v2.14.4(3)

Changes since MinGit v2.14.4(3) (June 19th 2018)

Bug Fixes

  * C:\ProgramData\Git\config's ownership is validated before it is used

MinGit for Windows v2.21.0(2)

Changes since MinGit v2.21.0(2) (Feb 26th 2019)

Bug Fixes

  * C:\ProgramData\Git\config's ownership is validated before it is used