summaryrefslogtreecommitdiff
path: root/Documentation
diff options
context:
space:
mode:
authorLibravatar Johannes Schindelin <johannes.schindelin@gmx.de>2021-02-12 15:47:47 +0100
committerLibravatar Johannes Schindelin <johannes.schindelin@gmx.de>2021-02-12 15:47:47 +0100
commitfb049fd85b298d386dca2e0bcf74a1f52a7b2038 (patch)
tree48d5164a342eb50fe9bacbdd3be510a786135062 /Documentation
parentGit 2.19.5 (diff)
parentGit 2.18.5 (diff)
downloadtgif-fb049fd85b298d386dca2e0bcf74a1f52a7b2038.tar.xz
Sync with 2.18.5
* maint-2.18: Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/RelNotes/2.17.6.txt16
-rw-r--r--Documentation/RelNotes/2.18.5.txt6
2 files changed, 22 insertions, 0 deletions
diff --git a/Documentation/RelNotes/2.17.6.txt b/Documentation/RelNotes/2.17.6.txt
new file mode 100644
index 0000000000..2f181e8064
--- /dev/null
+++ b/Documentation/RelNotes/2.17.6.txt
@@ -0,0 +1,16 @@
+Git v2.17.6 Release Notes
+=========================
+
+This release addresses the security issues CVE-2021-21300.
+
+Fixes since v2.17.5
+-------------------
+
+ * CVE-2021-21300:
+ On case-insensitive file systems with support for symbolic links,
+ if Git is configured globally to apply delay-capable clean/smudge
+ filters (such as Git LFS), Git could be fooled into running
+ remote code during a clone.
+
+Credit for finding and fixing this vulnerability goes to Matheus
+Tavares, helped by Johannes Schindelin.
diff --git a/Documentation/RelNotes/2.18.5.txt b/Documentation/RelNotes/2.18.5.txt
new file mode 100644
index 0000000000..dfb1de4ceb
--- /dev/null
+++ b/Documentation/RelNotes/2.18.5.txt
@@ -0,0 +1,6 @@
+Git v2.18.5 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.17.6 to address
+the security issue CVE-2021-21300; see the release notes for that
+version for details.