Re: [ANNOUNCE] Git 2.56.1 and friends

[Kaartic Sivaraam <kaartic.sivaraam@gmail.com>]

Hi Todd,

On 11/11/26 03:42, Todd Zullinger wrote:
> Junio C Hamano wrote:
>> Credit for organizing the set of these releases goes to Johannes
>> Schindelin.  Credit for finding the vulnerabilities goes to Luke
>> Martin and pwn2addr.  Credit for fixing them goes to Toon Claes,
>> Karthik Nayak, and Kaartic Sivaraam.  The xdiff hardening is based
>> on a patch by Jeff King, with help from Toon Claes and Christian
>> Couder.
> 
> Many thanks to all for the effort, including Junio.
>

Indeed. Thank you all for the efforts!
>> This addresses the security issues CVE-2026-111760, CVE-2026-113408,
>> CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
>>
>>   * CVE-2026-113408:
>>
>>     It is possible for a server to advertise an unborn HEAD that contains
>>     path-traversal characters (e.g., `refs/heads/../../../TARGET`). With
>>     the files ref backend that can lead to ref-updating actions to write
>>     to unwanted files.
>>
>>     See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
> 
> FWIW, this and the other GitLab work item links appear to be
> inaccessible to normal users.  I'm guessing that's not the
> intent.
> 
> I added Patrick to the Cc as one of the folks who may be
> able to poke the right folks at GitLab to open them up?
> 

Thank you for pointing it out. It was indeed not the intention. Those 
work items are accessible now.

-- 
Sivaraam