git-2.35.3

[Douglas R. Reno]

New point version.

Looks like a security update, specifically impacting multi-user systems

The Git project released versions v2.30.3, v2.31.2, v2.32.1,
v2.33.2, v2.34.2, and v2.35.2 today.  They are to address
CVE-2022-24765.  All supported platforms with multiple users are
affected in one way or another.

    https://lore.kernel.org/git/xmqqv8veb5i6.fsf@gitster.g/

We highly recommend to upgrade.

The addressed issue is:

* CVE-2022-24765:
  On multi-user machines, Git users might find themselves unexpectedly in
  a Git worktree, e.g. when there is a scratch space (`/scratch/`) intended
  for all users and another user created a repository in `/scratch/.git`.
  Merely having a Git-aware prompt that runs `git status` (or `git diff`)
  and navigating to a directory which is supposedly not a Git worktree, or
  opening such a directory in an editor or IDE such as VS Code or Atom, will
  potentially run commands defined by that other user via
  `/scratch/.git/config`.

[Douglas R. Reno]

Grab security updates

[ken@…]

2.35.3 now available, but I cannot find any release announcement.

[Douglas R. Reno]

... just as I finished 2.35.2. I'll check for release notes prior to committing.

[Douglas R. Reno]

Git v2.30.4 Release Notes
=========================

This release contains minor fix-ups for the changes that went into
Git 2.30.3, which was made to address CVE-2022-24765.

 * The code that was meant to parse the new `safe.directory`
   configuration variable was not checking what configuration
   variable was being fed to it, which has been corrected.

 * '*' can be used as the value for the `safe.directory` variable to
   signal that the user considers that any directory is safe.

Derrick Stolee (2):
      t0033: add tests for safe.directory
      setup: opt-out of check with safe.directory=*

Matheus Valadares (1):
      setup: fix safe.directory key not being checked

Looks like the changes are the exact same for the other versions per ​https://github.com/git/git/commit/d516b2db0af2221bd6b13e7347abdcb5830b2829 and ​https://github.com/git/git/commits/v2.35.3

[Douglas R. Reno]

Fixed at 09cf41d57a5e6b069096d19d9e8933009567c8a9

[Douglas R. Reno]

Security Advisory 11.1-029 issued