diff options
| author | Vincent Ambo <tazjin@google.com> | 2020-05-22T16·46+0100 |
|---|---|---|
| committer | Vincent Ambo <tazjin@google.com> | 2020-05-22T16·46+0100 |
| commit | 5229c9b232de5bfa959ad6ebbb4c8192ac513352 (patch) | |
| tree | 8539e7e23682cac110900f946f034ae44162cacd /third_party/git/Documentation/RelNotes/2.17.4.txt | |
| parent | f2b211131f2347342dde63975b09cf603149f1a3 (diff) | |
| parent | 8518a7a51faaf50f830646d4c3585f51236b9349 (diff) | |
merge(3p/git): Merge git upstream at v2.26.2 r/808
Diffstat (limited to 'third_party/git/Documentation/RelNotes/2.17.4.txt')
| -rw-r--r-- | third_party/git/Documentation/RelNotes/2.17.4.txt | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/third_party/git/Documentation/RelNotes/2.17.4.txt b/third_party/git/Documentation/RelNotes/2.17.4.txt new file mode 100644 index 000000000000..7d794ca01af2 --- /dev/null +++ b/third_party/git/Documentation/RelNotes/2.17.4.txt @@ -0,0 +1,16 @@ +Git v2.17.4 Release Notes +========================= + +This release is to address the security issue: CVE-2020-5260 + +Fixes since v2.17.3 +------------------- + + * With a crafted URL that contains a newline in it, the credential + helper machinery can be fooled to give credential information for + a wrong host. The attack has been made impossible by forbidding + a newline character in any value passed via the credential + protocol. + +Credit for finding the vulnerability goes to Felix Wilhelm of Google +Project Zero. |