|
2 | 2 | "vcs_url": "https://github.com/git-for-windows/git", |
3 | 3 | "vulnerabilities": { |
4 | 4 | "CVE-2025-66413": { |
| 5 | + "74e5d8abfacee02bea660da3aaeb6fa79ea6a42a": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
5 | 6 | "670fadf512d7d6009bf21d09faf4bda43e7829c2": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
6 | | - "1bca2137992877b0f68ac14dd804bc8d3ee046dd": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
7 | 7 | "f94d15b8dde0eea5838f93ae9d8a1cef645c90d1": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
8 | 8 | "ef1e97bd95df66d50c6d4b15b5b09bca943e0e96": "mingw: skip symlink type auto-detection for network share targets\n\nOn Windows, symbolic links come in two flavors: file symlinks and\ndirectory symlinks. Since Git was born on Linux where this distinction\ndoes not exist, Git for Windows has to auto-detect the type by looking\nat the target. When the target does not yet exist at symlink creation\ntime, Git for Windows creates a \"phantom\" file symlink and later, once\ncheckout is complete, calls `CreateFileW()` on the target to check\nwhether it is actually a directory.\n\nIf the symlink target is a UNC path (e.g. `\\\\attacker\\share`), this\nauto-detection triggers an SMB connection to the remote host. Windows\nperforms NTLM authentication by default for such connections, which\nmeans a crafted repository can exfiltrate the cloning user's NTLMv2\nhash to an attacker-controlled server without any user interaction\nbeyond `git clone -c core.symlinks=true <url>`.\n\nThere are ways to specify UNC paths that start with only a single\nbackslash (e.g. `\\??\\UNC\\host\\share`); All of them do start like\nthat, though, so let's use that as a tell-tale that we should skip\nthe auto-detection in `process_phantom_symlink()`. The symlink is\nthen left as a file symlink (the `mklink` default), and a warning is\nemitted suggesting the user set the `symlink` gitattribute to `dir`\nif a directory symlink is needed. When the attribute is already set,\nauto-detection is never invoked in the first place, so that code path\nis unaffected.\n\nThis is the same class of vulnerability as CVE-2025-66413\n(https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\nand follows the same general mitigation pattern that MinTTY adopted for\nANSI escape sequences referencing network share paths\n(https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5).\n\nNote that there are legitimate paths starting with a single backslash\nthat are _not_ network paths: drive-less absolute paths are interpreted\nas relative to the current working directory's drive. In practice, these\nare highly uncommon (and brittle, just one working directory change\naway from breaking). In any case, the only consequence is now that the\nsymlink type of those has to be specified via Git attributes, is all.\n\nReported-by: Justin Lee <jessdhoctor@gmail.com>\nAddresses: CVE-2026-32631\nAddresses: https://github.com/git-for-windows/git/security/advisories/GHSA-9j5h-h4m7-85hx\nAssisted-by: Claude Opus 4.6\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
9 | 9 | "c57c052ae8d8486d88f93f983db4439241669c8a": "mingw: skip symlink type auto-detection for network share targets\n\nOn Windows, symbolic links come in two flavors: file symlinks and\ndirectory symlinks. Since Git was born on Linux where this distinction\ndoes not exist, Git for Windows has to auto-detect the type by looking\nat the target. When the target does not yet exist at symlink creation\ntime, Git for Windows creates a \"phantom\" file symlink and later, once\ncheckout is complete, calls `CreateFileW()` on the target to check\nwhether it is actually a directory.\n\nIf the symlink target is a UNC path (e.g. `\\\\attacker\\share`), this\nauto-detection triggers an SMB connection to the remote host. Windows\nperforms NTLM authentication by default for such connections, which\nmeans a crafted repository can exfiltrate the cloning user's NTLMv2 hash\nto an attacker-controlled server without any user interaction beyond\n`git clone -c core.symlinks=true <url>`.\n\nThere are ways to specify UNC paths that start with only a single\nbackslash (e.g. `\\??\\UNC\\host\\share`); All of them do start like that,\nthough, so let's use that as a tell-tale that we should skip the\nauto-detection in `process_phantom_symlink()`. The symlink is then left\nas a file symlink (the `mklink` default), and a warning is emitted\nsuggesting the user set the `symlink` gitattribute to `dir` if a\ndirectory symlink is needed. When the attribute is already set,\nauto-detection is never invoked in the first place, so that code path is\nunaffected.\n\nThis is the same class of vulnerability as CVE-2025-66413\n(https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\nand follows the same general mitigation pattern that MinTTY adopted for\nANSI escape sequences referencing network share paths\n(https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5).\n\nNote that there are legitimate paths starting with a single backslash\nthat are _not_ network paths: drive-less absolute paths are interpreted\nas relative to the current working directory's drive. In practice, these\nare highly uncommon (and brittle, just one working directory change away\nfrom breaking). In any case, the only consequence is now that the\nsymlink type of those has to be specified via Git attributes, is all.\n\nReported-by: Justin Lee <jessdhoctor@gmail.com>\nAddresses: CVE-2026-32631\nAssisted-by: Claude Opus 4.6\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>", |
|
30 | 30 | "e9edee0b34751bf4d7d1feda0e2535bff64d4e77": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>" |
31 | 31 | }, |
32 | 32 | "GHSA-HV9C-4JM9-JH3X": { |
| 33 | + "74e5d8abfacee02bea660da3aaeb6fa79ea6a42a": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
33 | 34 | "670fadf512d7d6009bf21d09faf4bda43e7829c2": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
34 | | - "1bca2137992877b0f68ac14dd804bc8d3ee046dd": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
35 | 35 | "f94d15b8dde0eea5838f93ae9d8a1cef645c90d1": "Merge branch 'disallow-ntlm-auth-by-default'\n\nThis topic branch addresses the following vulnerability:\n\n- **CVE-2025-66413**:\n When a user clones a repository from an attacker-controlled server,\n Git may attempt NTLM authentication and disclose the user's NTLMv2 hash\n to the remote server. Since NTLM hashing is weak, the captured hash can\n potentially be brute-forced to recover the user's credentials. This is\n addressed by disabling NTLM authentication by default.\n (https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
36 | 36 | "ef1e97bd95df66d50c6d4b15b5b09bca943e0e96": "mingw: skip symlink type auto-detection for network share targets\n\nOn Windows, symbolic links come in two flavors: file symlinks and\ndirectory symlinks. Since Git was born on Linux where this distinction\ndoes not exist, Git for Windows has to auto-detect the type by looking\nat the target. When the target does not yet exist at symlink creation\ntime, Git for Windows creates a \"phantom\" file symlink and later, once\ncheckout is complete, calls `CreateFileW()` on the target to check\nwhether it is actually a directory.\n\nIf the symlink target is a UNC path (e.g. `\\\\attacker\\share`), this\nauto-detection triggers an SMB connection to the remote host. Windows\nperforms NTLM authentication by default for such connections, which\nmeans a crafted repository can exfiltrate the cloning user's NTLMv2\nhash to an attacker-controlled server without any user interaction\nbeyond `git clone -c core.symlinks=true <url>`.\n\nThere are ways to specify UNC paths that start with only a single\nbackslash (e.g. `\\??\\UNC\\host\\share`); All of them do start like\nthat, though, so let's use that as a tell-tale that we should skip\nthe auto-detection in `process_phantom_symlink()`. The symlink is\nthen left as a file symlink (the `mklink` default), and a warning is\nemitted suggesting the user set the `symlink` gitattribute to `dir`\nif a directory symlink is needed. When the attribute is already set,\nauto-detection is never invoked in the first place, so that code path\nis unaffected.\n\nThis is the same class of vulnerability as CVE-2025-66413\n(https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\nand follows the same general mitigation pattern that MinTTY adopted for\nANSI escape sequences referencing network share paths\n(https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5).\n\nNote that there are legitimate paths starting with a single backslash\nthat are _not_ network paths: drive-less absolute paths are interpreted\nas relative to the current working directory's drive. In practice, these\nare highly uncommon (and brittle, just one working directory change\naway from breaking). In any case, the only consequence is now that the\nsymlink type of those has to be specified via Git attributes, is all.\n\nReported-by: Justin Lee <jessdhoctor@gmail.com>\nAddresses: CVE-2026-32631\nAddresses: https://github.com/git-for-windows/git/security/advisories/GHSA-9j5h-h4m7-85hx\nAssisted-by: Claude Opus 4.6\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>", |
37 | 37 | "c57c052ae8d8486d88f93f983db4439241669c8a": "mingw: skip symlink type auto-detection for network share targets\n\nOn Windows, symbolic links come in two flavors: file symlinks and\ndirectory symlinks. Since Git was born on Linux where this distinction\ndoes not exist, Git for Windows has to auto-detect the type by looking\nat the target. When the target does not yet exist at symlink creation\ntime, Git for Windows creates a \"phantom\" file symlink and later, once\ncheckout is complete, calls `CreateFileW()` on the target to check\nwhether it is actually a directory.\n\nIf the symlink target is a UNC path (e.g. `\\\\attacker\\share`), this\nauto-detection triggers an SMB connection to the remote host. Windows\nperforms NTLM authentication by default for such connections, which\nmeans a crafted repository can exfiltrate the cloning user's NTLMv2 hash\nto an attacker-controlled server without any user interaction beyond\n`git clone -c core.symlinks=true <url>`.\n\nThere are ways to specify UNC paths that start with only a single\nbackslash (e.g. `\\??\\UNC\\host\\share`); All of them do start like that,\nthough, so let's use that as a tell-tale that we should skip the\nauto-detection in `process_phantom_symlink()`. The symlink is then left\nas a file symlink (the `mklink` default), and a warning is emitted\nsuggesting the user set the `symlink` gitattribute to `dir` if a\ndirectory symlink is needed. When the attribute is already set,\nauto-detection is never invoked in the first place, so that code path is\nunaffected.\n\nThis is the same class of vulnerability as CVE-2025-66413\n(https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x)\nand follows the same general mitigation pattern that MinTTY adopted for\nANSI escape sequences referencing network share paths\n(https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5).\n\nNote that there are legitimate paths starting with a single backslash\nthat are _not_ network paths: drive-less absolute paths are interpreted\nas relative to the current working directory's drive. In practice, these\nare highly uncommon (and brittle, just one working directory change away\nfrom breaking). In any case, the only consequence is now that the\nsymlink type of those has to be specified via Git attributes, is all.\n\nReported-by: Justin Lee <jessdhoctor@gmail.com>\nAddresses: CVE-2026-32631\nAssisted-by: Claude Opus 4.6\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>", |
|
0 commit comments