Re: [ANNOUNCE] Git 2.56.1 and friends

[Todd Zullinger]

Junio C Hamano wrote:
> Credit for organizing the set of these releases goes to Johannes
> Schindelin.  Credit for finding the vulnerabilities goes to Luke
> Martin and pwn2addr.  Credit for fixing them goes to Toon Claes,
> Karthik Nayak, and Kaartic Sivaraam.  The xdiff hardening is based
> on a patch by Jeff King, with help from Toon Claes and Christian
> Couder.

Many thanks to all for the effort, including Junio.

> This addresses the security issues CVE-2026-111760, CVE-2026-113408,
> CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
> 
>  * CVE-2026-113408:
> 
>    It is possible for a server to advertise an unborn HEAD that contains
>    path-traversal characters (e.g., `refs/heads/../../../TARGET`). With
>    the files ref backend that can lead to ref-updating actions to write
>    to unwanted files.
> 
>    See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.

FWIW, this and the other GitLab work item links appear to be
inaccessible to normal users.  I'm guessing that's not the
intent.

I added Patrick to the Cc as one of the folks who may be
able to poke the right folks at GitLab to open them up?

Cheers and thanks again,

-- 
Todd