-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  git (SSA:2022-291-01)

New git packages are available for Slackware 14.0, 14.1, 14.2, 15.0,
and -current to fix security issues.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/git-2.35.5-i586-1_slack15.0.txz:  Upgraded.
  This release fixes two security issues:
  * CVE-2022-39253:
  When relying on the `--local` clone optimization, Git dereferences
  symbolic links in the source repository before creating hardlinks
  (or copies) of the dereferenced link in the destination repository.
  This can lead to surprising behavior where arbitrary files are
  present in a repository's `$GIT_DIR` when cloning from a malicious
  repository.
  Git will no longer dereference symbolic links via the `--local`
  clone mechanism, and will instead refuse to clone repositories that
  have symbolic links present in the `$GIT_DIR/objects` directory.
  Additionally, the value of `protocol.file.allow` is changed to be
  "user" by default.
  * CVE-2022-39260:
  An overly-long command string given to `git shell` can result in
  overflow in `split_cmdline()`, leading to arbitrary heap writes and
  remote code execution when `git shell` is exposed and the directory
  `$HOME/git-shell-commands` exists.
  `git shell` is taught to refuse interactive commands that are
  longer than 4MiB in size. `split_cmdline()` is hardened to reject
  inputs larger than 2GiB.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/git-2.30.6-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/git-2.30.6-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/git-2.30.6-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/git-2.30.6-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/git-2.30.6-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/git-2.30.6-x86_64-1_slack14.2.txz

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/git-2.35.5-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/git-2.35.5-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/git-2.38.1-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/git-2.38.1-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
48ee1ee2b38d78db02f8a071685b9450  git-2.30.6-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
e28b635209f0609c6ef18e114a88fc16  git-2.30.6-x86_64-1_slack14.0.txz

Slackware 14.1 package:
1ad7ec8d222bbb240485dd62db3adf40  git-2.30.6-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
334f2f6a9eda3bb9a242d91fc40b97d4  git-2.30.6-x86_64-1_slack14.1.txz

Slackware 14.2 package:
346f1b5332fc9fa6c256578c6d2296f3  git-2.30.6-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
385741384f10e345bf736489096c7f63  git-2.30.6-x86_64-1_slack14.2.txz

Slackware 15.0 package:
c36b2529a04298271a42b54a2e22cd7c  git-2.35.5-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
cf2c3403da6faf885008e4fa7f9ff5c4  git-2.35.5-x86_64-1_slack15.0.txz

Slackware -current package:
44fd8361f0920419437471089a87e984  d/git-2.38.1-i586-1.txz

Slackware x86_64 -current package:
09bd553a683015bdcd1549ff4465d704  d/git-2.38.1-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg git-2.35.5-i586-1_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAmNPAiAACgkQakRjwEAQIjOEbwCdEeEouAfjt5zxgWFumrM/age6
3fwAmQGu/aG7xCb9kNgyTG/SOBijZDqT
=Y49V
-----END PGP SIGNATURE-----