4 ms·
> git 2.39.1 is already available on Ubuntu The updater just gave me 1:2.37.2-1ubuntu1.2 (to replace 1:2.37.2-1ubuntu1.1). It said it addresses the two CVEs in
by adrianmonk 4y ago
> git 2.39.1 is already available on Ubuntu
The updater just gave me 1:2.37.2-1ubuntu1.2 (to replace 1:2.37.2-1ubuntu1.1). It said it addresses the two CVEs in question.
So they (Ubuntu or maybe Debian) are taking the approach of patching a slightly older git version.
- tomxor 4y agoI'm not sure why they aren't bumping the patch number, maybe they decided against applying the other parts of the patch for least change - but at least the CVEs are mentioned in all of the Ubuntu changelogs. I can't find anything in the Debian changelogs referring to the CVEs. Yet the Ubuntu changelog refers to it as a debian patch... Anyone know anything about Debian?
- deleted 4y ago[deleted]
- foresto 4y agoLooks like it's tracked in Debian, but not addressed yet. https://security-tracker.debian.org/tracker/CVE-2022-23521 https://security-tracker.debian.org/tracker/CVE-2022-23521 https://security-tracker.debian.org/tracker/CVE-2022-41903 https://security-tracker.debian.org/tracker/CVE-2022-41903 https://www.debian.org/security/2023/ https://www.debian.org/security/2023/ https://tracker.debian.org/pkg/git https://tracker.debian.org/pkg/git
- tomxor 4y agoThank you!