Re: [ANNOUNCE] Git 2.56.1 and friends

[Kaartic Sivaraam]

Hi Todd,

On 11/11/26 03:42, Todd Zullinger wrote:
> Junio C Hamano wrote:
> > Credit for organizing the set of these releases goes to Johannes
> > Schindelin.  Credit for finding the vulnerabilities goes to Luke
> > Martin and pwn2addr.  Credit for fixing them goes to Toon Claes,
> > Karthik Nayak, and Kaartic Sivaraam.  The xdiff hardening is based
> > on a patch by Jeff King, with help from Toon Claes and Christian
> > Couder.
>
> Many thanks to all for the effort, including Junio.

Indeed. Thank you all for the efforts!
> > This addresses the security issues CVE-2026-111760, CVE-2026-113408,
> > CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
> >
> >   * CVE-2026-113408:
> >
> >     It is possible for a server to advertise an unborn HEAD that contains
> >     path-traversal characters (e.g., `refs/heads/../../../TARGET`). With
> >     the files ref backend that can lead to ref-updating actions to write
> >     to unwanted files.
> >
> >     See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
>
> FWIW, this and the other GitLab work item links appear to be
> inaccessible to normal users.  I'm guessing that's not the
> intent.
>
> I added Patrick to the Cc as one of the folks who may be
> able to poke the right folks at GitLab to open them up?

Thank you for pointing it out. It was indeed not the intention. Those 
work items are accessible now.

--
Sivaraam