3 ms·

$ brew install git $ git --version git version 2.8.1

by xyzzy123 11y ago

tadfisher 11y ago
Now grep your system for `/usr/bin/git`.
- xyzzy123 11y ago
  $ grep -rc /usr/bin/git /usr/bin/ /usr/local/bin/ /usr/sbin/ /sbin/ | grep -v ':0' | wc -l 0
  - emmelaich 11y ago
    er.. find /usr/bin/ /usr/local/bin/ /usr/sbin/ /sbin/ |grep -w git
    - fjarlq 11y ago
      But that merely enumerates pathnames that contain the word "git", not programs that might still invoke the vulnerable version of git directly via "/usr/bin/git".
      - mitchty 11y ago
        So then give find a proper predicate: $ find /usr -name git -type f -xdev -exec {} -v \;
        fjarlq 11y ago
        No... tadfisher's point was that even if a fixed version of git is installed, some other program -- say, a wrapper script for git -- might still invoke OS X's vulnerable version if it directly references "/usr/bin/git". So, such a system could become compromised if that wrapper script was used to access an untrustworthy repo. All your invocation of find does is enumerate every file (or directory) under /usr named "git" and execute it with the -v option. In addition to dumping a lot of error messages, all that would do is eventually run "/usr/bin/git -v" and inform you that yep, your system still has the vulnerable version of git installed. In other words, tadfisher's point, which I now wish had been made explicitly, is that simply installing the fixed version of git is possibly insufficient to secure your system. You also ought to either disable /usr/bin/git or convince yourself that no program will invoke it. Disabling /usr/bin/git is probably easier.
paradite 11y ago
Weird, I got git 2.6.1 using the same command: $ brew install git ==> Downloading https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bottle.tar.gz https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bo... $ git version git version 2.6.1 $ brew upgrade git Error: git 2.6.1 already installed
- yelnatz 11y ago
  I did the same and its refusing to let me replace it.
- jewbacca 11y ago
  Outdated package list. try: brew update brew upgrade git
- teoruiz 11y ago
  Try with `brew upgrade git`
- bestest 11y ago
  Now refresh the current shell or open a new terminal window, and try git --version once again. Version should be good. Reason for this being old shell environment not being aware that you updated the environment path.
deleted 11y ago
[deleted]

$ brew install git $ git --version git version 2.8.1

tadfisher 11y ago

Now grep your system for `/usr/bin/git`.

xyzzy123 11y ago
$ grep -rc /usr/bin/git /usr/bin/ /usr/local/bin/ /usr/sbin/ /sbin/ | grep -v ':0' | wc -l 0
- emmelaich 11y ago
  er.. find /usr/bin/ /usr/local/bin/ /usr/sbin/ /sbin/ |grep -w git
  - fjarlq 11y ago
    But that merely enumerates pathnames that contain the word "git", not programs that might still invoke the vulnerable version of git directly via "/usr/bin/git".
    - mitchty 11y ago
      So then give find a proper predicate: $ find /usr -name git -type f -xdev -exec {} -v \;
      - fjarlq 11y ago
        No... tadfisher's point was that even if a fixed version of git is installed, some other program -- say, a wrapper script for git -- might still invoke OS X's vulnerable version if it directly references "/usr/bin/git". So, such a system could become compromised if that wrapper script was used to access an untrustworthy repo. All your invocation of find does is enumerate every file (or directory) under /usr named "git" and execute it with the -v option. In addition to dumping a lot of error messages, all that would do is eventually run "/usr/bin/git -v" and inform you that yep, your system still has the vulnerable version of git installed. In other words, tadfisher's point, which I now wish had been made explicitly, is that simply installing the fixed version of git is possibly insufficient to secure your system. You also ought to either disable /usr/bin/git or convince yourself that no program will invoke it. Disabling /usr/bin/git is probably easier.

paradite 11y ago

Weird, I got git 2.6.1 using the same command: $ brew install git ==> Downloading https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bottle.tar.gz https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bo... $ git version git version 2.6.1 $ brew upgrade git Error: git 2.6.1 already installed

yelnatz 11y ago
I did the same and its refusing to let me replace it.
jewbacca 11y ago
Outdated package list. try: brew update brew upgrade git
teoruiz 11y ago
Try with `brew upgrade git`
bestest 11y ago
Now refresh the current shell or open a new terminal window, and try git --version once again. Version should be good. Reason for this being old shell environment not being aware that you updated the environment path.

deleted 11y ago

[deleted]