diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-10-30 00:52:16 +0100 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-11-26 22:14:59 +0100 |
| commit | c39c2d29e62d5bd13f390ca20f6e756aced681b1 (patch) | |
| tree | 63a1b00a4df948d65f46b0d3cc382bfe4037085a /Documentation | |
| parent | 337b4d400023d22207bcc3c29e9ebab31bf96fc2 (diff) | |
| parent | 54ddf17f827969c989576f2411d9ff519fa8091f (diff) | |
| download | git-c39c2d29e62d5bd13f390ca20f6e756aced681b1.tar.gz | |
Sync with 2.42.4
* maint-2.42:
Git 2.42.4
Git 2.41.3
Git 2.40.4
credential: disallow Carriage Returns in the protocol by default
credential: sanitize the user prompt
credential_format(): also encode <host>[:<port>]
t7300: work around platform-specific behaviour with long paths on MinGW
compat/regex: fix argument order to calloc(3)
mingw: drop bogus (and unneeded) declaration of `_pgmptr`
ci: remove 'Upload failed tests' directories' step from linux32 jobs
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/RelNotes/2.40.4.txt | 5 | ||||
| -rw-r--r-- | Documentation/RelNotes/2.41.3.txt | 6 | ||||
| -rw-r--r-- | Documentation/RelNotes/2.42.4.txt | 6 | ||||
| -rw-r--r-- | Documentation/config/credential.txt | 11 |
4 files changed, 28 insertions, 0 deletions
diff --git a/Documentation/RelNotes/2.40.4.txt b/Documentation/RelNotes/2.40.4.txt new file mode 100644 index 0000000000..0ff29f3cfc --- /dev/null +++ b/Documentation/RelNotes/2.40.4.txt @@ -0,0 +1,5 @@ +Git v2.40.4 Release Notes +========================= + +This release lets Git refuse to accept URLs that contain control +sequences. This addresses CVE-2024-50349 and CVE-2024-52006. diff --git a/Documentation/RelNotes/2.41.3.txt b/Documentation/RelNotes/2.41.3.txt new file mode 100644 index 0000000000..b5aba88790 --- /dev/null +++ b/Documentation/RelNotes/2.41.3.txt @@ -0,0 +1,6 @@ +Git v2.41.3 Release Notes +========================= + +This release merges up the fix that appears in v2.40.4 to address +the security issues CVE-2024-50349 and CVE-2024-52006; see the +release notes for that version for details. diff --git a/Documentation/RelNotes/2.42.4.txt b/Documentation/RelNotes/2.42.4.txt new file mode 100644 index 0000000000..3129d76e75 --- /dev/null +++ b/Documentation/RelNotes/2.42.4.txt @@ -0,0 +1,6 @@ +Git v2.42.4 Release Notes +========================= + +This release merges up the fix that appears in v2.40.4 and v2.41.3 +to address the security issues CVE-2024-50349 and CVE-2024-52006; +see the release notes for these versions for details. diff --git a/Documentation/config/credential.txt b/Documentation/config/credential.txt index 0221c3e620..41951918c0 100644 --- a/Documentation/config/credential.txt +++ b/Documentation/config/credential.txt @@ -14,6 +14,17 @@ credential.useHttpPath:: or https URL to be important. Defaults to false. See linkgit:gitcredentials[7] for more information. +credential.sanitizePrompt:: + By default, user names and hosts that are shown as part of the + password prompt are not allowed to contain control characters (they + will be URL-encoded by default). Configure this setting to `false` to + override that behavior. + +credential.protectProtocol:: + By default, Carriage Return characters are not allowed in the protocol + that is used when Git talks to a credential helper. This setting allows + users to override this default. + credential.username:: If no username is set for a network authentication, use this username by default. See credential.<context>.* below, and |