Skip to content

Makefile: Update Git to v2.37.1

Patrick Steinhardt requested to merge pks-git-v2.37.1 into master

Update our bundled Git version to v2.37.1. This both updates our major version to include the latest changes from v2.37, but also updates our minor version to include fixes for CVE-2022-29187, which is another variant of opening repositories owned by a different user leading to privilege escalation.

To the best of my knowledge, Gitaly is not impacted by this specific vulnerability. It does not perform repository discovery by walking up the filesystem hierarchy and thus wouldn't pick up repositories in any of the parent directories of the storage root. And if an adversary is in a posititon to change the owner of repositories contained in Gitaly's storage root, they would already have other ways to attack the host.

Also note that we're upgrading the bundled Git version v2.36.1 in-place. This can be done because its feature flag is not yet default-enabled and hasn't been rolled out anywhere due to a set of incompatibilities.

Merge request reports