Git 2.56.1 fixes six security vulnerabilities, update now
· FPTWaze news desk
Git 2.56.1 and patched releases for older series fix six security flaws, including code execution during recursive clones. Update soon.
The Git project has released new versions that fix six security vulnerabilities in Git, the widely used version control system. Users should install a fixed version as soon as possible, including applications that bundle their own copy of Git.
The fixes are in Git 2.56.1. Patched releases for older maintenance series are also available: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Install the release that matches your series.
The fixed issues include: - Code execution during recursive clones, caused by an integer truncation in index handling. - Path traversal through a server's advertised HEAD when cloning an empty repository with protocol v2. - Stack corruption when removing GPG signatures from messages with more than two signatures. - Out-of-bounds reads when applying binary patches that expand past the size limit after decompression. - Heap corruption during very large merges, caused by an overflow in a memory size calculation. - Filesystem access through some git fast-import features, which are now blocked unless --allow-unsafe-features is set.
Hosting services that merge content or tags for users can also be affected. GitHub says it has deployed fixes on github.com and GitHub Enterprise Cloud, and that GitHub Desktop, the GitHub Copilot app, GitHub Codespaces, and GitHub Actions will receive patched versions of Git.
If you cannot update right away, clone only from trusted servers, avoid recursive clones of untrusted repositories, and avoid merging untrusted content or processing untrusted binary patches or fast-import streams. These steps do not replace installing the fix.
Source: GitHub Blog ↗. This summary is prepared automatically from the official source and may contain mistakes; the source is authoritative.