Multiple Git vulnerabilities in 2.24 and older
github.blog
github.blog
I really hack up habitat plans with a common include script to screen scrape source websites to get the latest version and check GPG signatures rather than depending on embedded hashes.