From 3e46e455e39b6572d07aa44edb3c9c9a024a8dd1 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Wed, 9 Jul 2025 18:36:24 +0200 Subject: [PATCH] package/git: security bump to v2.48.2 Read the announcement: https://lwn.net/ml/all/xmqq5xg2wrd1.fsf@gitster.g/ This fixes the following vulnerabilities: - CVE-2025-27613 (Gitk): When a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option "Support per-file encoding" must have been enabled. The operation "Show origin of this line" is affected as well, regardless of the option being enabled or not. https://www.cve.org/CVERecord?id=CVE-2025-27613 - CVE-2025-27614 (Gitk): A Git repository can be crafted in such a way that a user who has cloned the repository can be tricked into running any script supplied by the attacker by invoking `gitk filename`, where `filename` has a particular structure. https://www.cve.org/CVERecord?id=CVE-2025-27614 - CVE-2025-46835 (Git GUI): When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite any writable file. https://www.cve.org/CVERecord?id=CVE-2025-46835 - CVE-2025-48384: When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. https://www.cve.org/CVERecord?id=CVE-2025-48384 - CVE-2025-48385: When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. https://www.cve.org/CVERecord?id=CVE-2025-48385 - CVE-2025-48386: The wincred credential helper uses a static buffer (`target`) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with `wcsncat()`, leading to potential buffer overflows. https://www.cve.org/CVERecord?id=CVE-2025-48386 Signed-off-by: Titouan Christophe (cherry picked from commit 62788e0e497ab8e8b6f2819a72c3b391ed3807eb) [thomas: bumped to v2.48.2 instead] Signed-off-by: Thomas Perale --- package/git/git.hash | 2 +- package/git/git.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/git/git.hash b/package/git/git.hash index 7608cbe176..24286a8705 100644 --- a/package/git/git.hash +++ b/package/git/git.hash @@ -1,5 +1,5 @@ # From: https://www.kernel.org/pub/software/scm/git/sha256sums.asc -sha256 1c5d545f5dc1eb51e95d2c50d98fdf88b1a36ba1fa30e9ae5d5385c6024f82ad git-2.48.1.tar.xz +sha256 30ce5660fc6be0453ab0e15ba3f2b69f2325cde0bb447ad2ee1b559f2999e494 git-2.48.2.tar.xz # Locally calculated sha256 5b2198d1645f767585e8a88ac0499b04472164c0d2da22e75ecf97ef443ab32e COPYING sha256 1922f45d2c49e390032c9c0ba6d7cac904087f7cec51af30c2b2ad022ce0e76a LGPL-2.1 diff --git a/package/git/git.mk b/package/git/git.mk index de3103f4ff..18d768e900 100644 --- a/package/git/git.mk +++ b/package/git/git.mk @@ -4,7 +4,7 @@ # ################################################################################ -GIT_VERSION = 2.48.1 +GIT_VERSION = 2.48.2 GIT_SOURCE = git-$(GIT_VERSION).tar.xz GIT_SITE = $(BR2_KERNEL_MIRROR)/software/scm/git GIT_LICENSE = GPL-2.0, LGPL-2.1+