| Git v2.30.9 Release Notes | |
| ========================= | |
| This release addresses the security issues CVE-2023-25652, | |
| CVE-2023-25815, and CVE-2023-29007. | |
| Fixes since v2.30.8 | |
| ------------------- | |
| * CVE-2023-25652: | |
| By feeding specially crafted input to `git apply --reject`, a | |
| path outside the working tree can be overwritten with partially | |
| controlled contents (corresponding to the rejected hunk(s) from | |
| the given patch). | |
| * CVE-2023-25815: | |
| When Git is compiled with runtime prefix support and runs without | |
| translated messages, it still used the gettext machinery to | |
| display messages, which subsequently potentially looked for | |
| translated messages in unexpected places. This allowed for | |
| malicious placement of crafted messages. | |
| * CVE-2023-29007: | |
| When renaming or deleting a section from a configuration file, | |
| certain malicious configuration values may be misinterpreted as | |
| the beginning of a new configuration section, leading to arbitrary | |
| configuration injection. | |
| Credit for finding CVE-2023-25652 goes to Ry0taK, and the fix was | |
| developed by Taylor Blau, Junio C Hamano and Johannes Schindelin, | |
| with the help of Linus Torvalds. | |
| Credit for finding CVE-2023-25815 goes to Maxime Escourbiac and | |
| Yassine BENGANA of Michelin, and the fix was developed by Johannes | |
| Schindelin. | |
| Credit for finding CVE-2023-29007 goes to André Baptista and Vítor Pinho | |
| of Ethiack, and the fix was developed by Taylor Blau, and Johannes | |
| Schindelin, with help from Jeff King, and Patrick Steinhardt. |