about summary refs log tree commit diff
path: root/third_party/git/Documentation/RelNotes/2.14.5.txt
diff options
context:
space:
mode:
Diffstat (limited to 'third_party/git/Documentation/RelNotes/2.14.5.txt')
-rw-r--r--third_party/git/Documentation/RelNotes/2.14.5.txt16
1 files changed, 16 insertions, 0 deletions
diff --git a/third_party/git/Documentation/RelNotes/2.14.5.txt b/third_party/git/Documentation/RelNotes/2.14.5.txt
new file mode 100644
index 000000000000..130645fb292a
--- /dev/null
+++ b/third_party/git/Documentation/RelNotes/2.14.5.txt
@@ -0,0 +1,16 @@
+Git v2.14.5 Release Notes
+=========================
+
+This release is to address the recently reported CVE-2018-17456.
+
+Fixes since v2.14.4
+-------------------
+
+ * Submodules' "URL"s come from the untrusted .gitmodules file, but
+   we blindly gave it to "git clone" to clone submodules when "git
+   clone --recurse-submodules" was used to clone a project that has
+   such a submodule.  The code has been hardened to reject such
+   malformed URLs (e.g. one that begins with a dash).
+
+Credit for finding and fixing this vulnerability goes to joernchen
+and Jeff King, respectively.