From 38bebdea1941e8d2749751a20dc73593ec014f1a Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 22 Jan 2025 17:56:16 +0100 Subject: [PATCH] package/git: security bump to version 2.47.2 Fixes the following vulnerabilities: - CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the user susceptible to crafted URLs (e.g. in recursive clones) that mislead the user into typing in passwords for trusted sites that would then be sent to untrusted sites instead. - CVE-2024-52006 Git may pass on Carriage Returns via the credential protocol to credential helpers which use line-reading functions that interpret said Carriage Returns as line endings, even though Git did not intend that. For more details, see the announcement: https://lore.kernel.org/git/xmqq5xmh46oc.fsf@gitster.g/ Additionally, 2.47.1 contained a number of fixes: https://lore.kernel.org/git/xmqq5xob6coo.fsf@gitster.g/ Signed-off-by: Peter Korsgaard --- package/git/git.hash | 2 +- package/git/git.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/git/git.hash b/package/git/git.hash index c290ebe6bd..97ba3936db 100644 --- a/package/git/git.hash +++ b/package/git/git.hash @@ -1,5 +1,5 @@ # From: https://www.kernel.org/pub/software/scm/git/sha256sums.asc -sha256 1ce114da88704271b43e027c51e04d9399f8c88e9ef7542dae7aebae7d87bc4e git-2.47.0.tar.xz +sha256 b19268be6b6f1556b47a9dd834272e167d3a75740cdcd283cf3812edffe3930f git-2.47.2.tar.xz # Locally calculated sha256 5b2198d1645f767585e8a88ac0499b04472164c0d2da22e75ecf97ef443ab32e COPYING sha256 1922f45d2c49e390032c9c0ba6d7cac904087f7cec51af30c2b2ad022ce0e76a LGPL-2.1 diff --git a/package/git/git.mk b/package/git/git.mk index f56807a00f..397a6984ba 100644 --- a/package/git/git.mk +++ b/package/git/git.mk @@ -4,7 +4,7 @@ # ################################################################################ -GIT_VERSION = 2.47.0 +GIT_VERSION = 2.47.2 GIT_SOURCE = git-$(GIT_VERSION).tar.xz GIT_SITE = $(BR2_KERNEL_MIRROR)/software/scm/git GIT_LICENSE = GPL-2.0, LGPL-2.1+