Git security vulnerability announced

Post by jwilk » Wed, Apr 13, 2022, 9:23 AM UTC

hsbauauvhabzb wrote: post #154

kadoban wrote: post #69

Earlier quoted context omitted.

You don't have to trust repos you clone, if I understand correctly. You just need to trust ones you're given in other ways. The difference is, clone won't let you set up arbitrary config (or malformed internal data or etc.)

Can you store a .git/config filepath in a git repository, either via the cli or manually hacking the repo data files?

Post by avgcorrection » Wed, Apr 13, 2022, 9:41 AM UTC

rectang wrote: post #147

zmmmmm wrote: post #146

And .... there go probably tens of thousands of person-hours of human effort due to fixing this across huge numbers of systems. It's fascinating to me that we have people out there just casually making these kind of decisions with enormous cost implications with barely any thought to the downstream implications. Then meanwhile, we need approval in our org to claim a $30 taxi voucher as an expense.

It boggles the mind that someone thinks security decisions like these are made casually. Staying sane as an open source maintainer means ignoring such thanklessness as best you can.

Post by dgellow » Wed, Apr 13, 2022, 9:43 AM UTC

AlbertoAsw10 wrote: post #215

tommiegannert wrote: post #178

> Run the uninstaller under an administrator account rather than as the SYSTEM user How do I run something as SYSTEM? I thought I always ran as "me" or Administrator. Is this only likely to happen for deployment automation tools? > Avoid running the uninstaller until after upgrading Don't leave us with this cliff-hanger... Does the upgrade installer run the uninstaller first? (The original report doesn't have this bu…

af

Post by dgellow » Wed, Apr 13, 2022, 9:49 AM UTC

sharken wrote: post #220

Interestingly if you're on Windows, then Chocolatey is the better package manager to use. Microsoft's own package manager Winget only has v2.34.1 right now. Chocolatey https://community.chocolatey.org/packages/git#versionhistory Winget https://winget.run/pkg/Git/Git

    Found Git [Git.Git]
    Version: 2.35.2
    Publisher: The Git Development Community
    Publisher Url: https://gitforwindows.org
    Publisher Support Url: https://github.com/git-for-windows/git/issues
    Author: Johannes Schindelin
    Moniker: git
    Description: Git for Windows focuses on offering a lightweight, native set of tools that bring the full feature set of the Git SCM to Windows while providing appropriate user interfaces for experienced Git users and novices alike.
    Homepage: https://gitforwindows.org
    License: GNU General Public License version 2
    License Url: https://raw.githubusercontent.com/git-for-windows/git/main/COPYING
    Copyright: Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    Copyright Url: https://raw.githubusercontent.com/git-for-windows/git/main/COPYING
    Installer:
    Type: inno
    Download Url: https://github.com/git-for-windows/git/releases/download/v2.35.2.windows.1/Git-2.35.2-64-bit.exe
    SHA256: 8d33512f097e79adf7910d917653e630b3a4446b25fe258f6c3a21bdbde410ca

Post by vtbassmatt » Wed, Apr 13, 2022, 10:09 AM UTC

Matheus28 wrote: post #45

db48x wrote: post #41

Earlier quoted context omitted.

Fun :) Going to send an email the old–fashioned way?

Gonna beg in the irc channel for git so they give me access to that bot. God forbid I have to format a patch the way they want me to