""" Team, The Git project released new security bug-fix versions today, May 14th, 2024: v2.45.1, v2.44.1, v2.43.4, v2.42.2, v2.41.1, v2.40.2, and v2.39.4. The addressed issues are: * CVE-2024-32002 * (https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv): Recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion that can be exploited to execute just-cloned code during the clone operation. This allows the attack where a recursive clone would first initialize a submodule, then replace its parent directory with a symbolic link into the `.git/` directory where the second stage of the recursive clone would then write e.g. hooks that would be immediately executed before the user has had a chance to inspect what is getting executed. Credit for finding the vulnerability goes to Filip Hejsek, credit for fixing it goes to Johannes Schindelin. * CVE-2024-32004 * (https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389): Repositories can be configured to execute arbitrary code during local clones. To address this, the ownership checks introduced in v2.30.3 are now extended to cover cloning local repositories. The most obvious attack vector is to prepare a local partial clone that is intentionally missing objects, override in its config what `upload-pack` executable use, and then talk another user on the same machine to clone that. This will run that configured `upload-pack` executable under using person's permissions. Credit for finding the vulnerability goes to Filip Hejsek, credit for fixing it goes to Johannes Schindelin. * CVE-2024-32020 * (https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj): Local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. This vulnerability allows a bait-and-switch attack where individual objects are replaced in already-indexed pack file; Git will not verify that the object's contents match its recorded object ID in that case. Credit for finding and for fixing the vulnerability goes to Patrick Steinhardt. * CVE-2024-32021 * (https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7): When cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the objects/ directory. This allows the same attack vector that CVE-2022-39253 tried to prevent, by exploiting a time-of-check-time-of-use race. Credit for finding and for fixing the vulnerability goes to Patrick Steinhardt. * CVE-2024-32465 * (https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4): It is supposed to be safe to clone untrusted repositories, even those unpacked from zip archives or tarballs originating from untrusted sources, but Git can be tricked to run arbitrary code as part of the clone. The attack vectors are the same as for the CVEs mentioned above that involve local clones, but social-engineering is required to manipulate a user into unpacking a `.zip` file and running Git commands on the unpacked files. Credit for finding and for fixing the vulnerability goes to Jeff King. """
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a7b443b0c2cffccfd5d8fef26d2e666192944525 commit a7b443b0c2cffccfd5d8fef26d2e666192944525 Author: Sam James <sam@gentoo.org> AuthorDate: 2024-05-15 12:04:21 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-05-15 12:05:08 +0000 dev-vcs/git: add 2.45.1 Bug: https://bugs.gentoo.org/931941 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/Manifest | 3 + dev-vcs/git/git-2.45.1.ebuild | 646 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 649 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ce8e7c222121abec49371ca80f7dc86eccf5e9f commit 6ce8e7c222121abec49371ca80f7dc86eccf5e9f Author: Sam James <sam@gentoo.org> AuthorDate: 2024-05-15 11:53:55 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-05-15 12:05:07 +0000 dev-vcs/git: add 2.44.1 Bug: https://bugs.gentoo.org/931941 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/Manifest | 3 + dev-vcs/git/git-2.44.1.ebuild | 647 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 650 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c33ce83db9529c38bdaa2db0d552893a2ab235b commit 6c33ce83db9529c38bdaa2db0d552893a2ab235b Author: Sam James <sam@gentoo.org> AuthorDate: 2024-05-15 11:43:07 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-05-15 12:05:06 +0000 dev-vcs/git: add 2.43.4 Bug: https://bugs.gentoo.org/931941 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/Manifest | 3 + dev-vcs/git/git-2.43.4.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 647 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f9a42a726076be2900b5c6718e854a95d17318b1 commit f9a42a726076be2900b5c6718e854a95d17318b1 Author: Sam James <sam@gentoo.org> AuthorDate: 2024-05-15 11:35:28 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-05-15 12:05:05 +0000 dev-vcs/git: add 2.41.1 Bug: https://bugs.gentoo.org/931941 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/Manifest | 3 + dev-vcs/git/git-2.41.1.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 647 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7fb5aefa50c69372e653f9890d9fcfccc8ea5b0a commit 7fb5aefa50c69372e653f9890d9fcfccc8ea5b0a Author: Sam James <sam@gentoo.org> AuthorDate: 2024-05-15 11:29:25 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-05-15 12:05:05 +0000 dev-vcs/git: add 2.39.4 Bug: https://bugs.gentoo.org/931941 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/Manifest | 3 + dev-vcs/git/git-2.39.4.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 647 insertions(+)
I've cranked the stablereqs to handle bug 932091.
