Comment by nodesocket | Hacker News Reader

Comment by nodesocket | Hacker News Reader

Will Ubuntu update to v2.35.2? My current install is using the elder v2.25.1:

  ubuntu@vpn1:$ git --version
  git version 2.25.1

  ubuntu@vpn1:$ cat /etc/os-release
  NAME="Ubuntu"
  VERSION="20.04.4 LTS (Focal Fossa)"
  ID=ubuntu
  ID_LIKE=debian
  PRETTY_NAME="Ubuntu 20.04.4 LTS"
  VERSION_ID="20.04"
  HOME_URL="https://www.ubuntu.com/"
  SUPPORT_URL="https://help.ubuntu.com/"
  BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
  PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
  VERSION_CODENAME=focal
  UBUNTU_CODENAME=focal

Same for debian 11 bullseye, which is today on git 2.30.2 . I'm not too worried, if someone besides me manages to create a /home/.git, then I'm already owned. But it's a bit surprising.

I assume the patch will be backported and there will be a point release .30.? including it, but bullseye will probably sticks with 2.30.

However, you can use bullseye-backports to get 2.34.1 if you want: See https://packages.debian.org/git

Edit: None of the debian versions have the patch yet: https://security-tracker.debian.org/tracker/CVE-2022-24765

A fix has already been released: https://ubuntu.com/security/CVE-2022-24765

So does that mean git v2.25.1 is patched? That’s what my Ubuntu 20.04 is running now.

Since the security bug is windows-specific, you could play it cool.

CVE-2022-24765 is not Windows-specific.

It's not windows-specific. It's just that the git-for-windows people are more receptive to the idea of this being a security bug.

The behavior is cross-platform.

Reply on news.ycombinator.com