Integrate the security fix release 2.55.0.vfs.0.8 - #978
Open
Johannes Schindelin (dscho) wants to merge 9 commits into
Open
Integrate the security fix release 2.55.0.vfs.0.8#978Johannes Schindelin (dscho) wants to merge 9 commits into
Johannes Schindelin (dscho) wants to merge 9 commits into
Conversation
These gaps were identified while upstreaming the patches. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
While upstreaming the patch, it was pointed out that we should now drop that prereq. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
While upstreaming the patch, it was pointed out that we should now drop that prereq. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
While upstreaming the patch, it was pointed out that we should now drop that prereq. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
While upstreaming the patch, it was pointed out that we should now drop that prereq. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The earlier d22a488 (wincred: avoid memory corruption, 2025-11-17) repaired only get_credential(); match_cred_password() has the same defect and is reached on `git credential reject`. When Git asks the helper to erase a stored credential whose password was supplied by the caller, the helper copies the candidate's password into a freshly allocated buffer for comparison. That copy overruns the allocation by one WCHAR of NUL, which on uninstrumented Windows manifests as process termination with status 0xC0000374. Because the helper can die before reaching CredDeleteW(), `git credential reject` masks the failure and the rejected credential remains stored. CredentialBlobSize is documented as a byte count, so for an N-WCHAR blob it equals N * sizeof(WCHAR). The pre-fix code allocated that many bytes and asked wcsncpy_s to copy N wide characters, but wcsncpy_s always appends a terminating NUL WCHAR, writing one WCHAR past the allocation. The destination-capacity argument was also passed in bytes rather than in WCHAR elements as the API requires, so the safe-CRT runtime never rejected the copy. See GHSA-rxqw-wxqg-g7hw. Assisted-by: Opus 4.7 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
When `git credential approve` hands the wincred helper a password together with an `oauth_refresh_token`, the OAuth branch of `store_credential()` writes one WCHAR past the allocation while formatting both fields into a single `CredentialBlob`. On Windows this trips heap verification and tears the helper down with status `0xC0000374`; `approve` masks the failure, so the credential the user meant to save never reaches `CredWriteW()` and the next session prompts for it again. The bug has the same shape as the one fixed in the previous commit: the allocation leaves no room for the terminating NUL, and the `sizeOfBuffer` argument to `_snwprintf_s()` is a byte count where the API expects a WCHAR count, which lets the safe-CRT runtime write the terminator out of bounds. Apply the same remedy d22a488 (wincred: avoid memory corruption, 2025-11-17) applied in `get_credential()`: allocate `(wlen + 1) * sizeof(WCHAR)` bytes and pass `wlen + 1` as the destination capacity in WCHARs. This closes the second of the two heap writes tracked under GHSA-rxqw-wxqg-g7hw. Assisted-by: Opus 4.7 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Servers may advertise bundle URIs that are not HTTP(S); copy_uri_to_file() then opens it as a local path. On Windows that can be a UNC path like `//attacker/share/x`, i.e. a clone can be manipulated into making an outbound SMB connection that leaks NTLM credentials (CVE-2026-62960). Subject advertised URIs to the usual protocol allow-list (`protocol.*.allow`), which drops "file" (and bare/UNC paths) by default but keeps http/https/git/ssh. Do it in fetch_bundle_list(), the clone/fetch consume path, so ls-remote still lists everything; each skipped URI is reported. A user-supplied `--bundle-uri` is unaffected, and `protocol.file.allow=always` re-enables an advertised file URI. Assisted-by: Opus 4.7 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Git for Windows v2.55.0(4)
Changes since Git for Windows v2.55.0(3) (July 14th 2026):
Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support will be dropped after Git for Windows v2.55.
This is a security fix release, addressing CVE-2026-62960.
* CVE-2026-62960, Git for Windows: Attacker-controlled servers may
advertise bundle URIs that point to network shares, causing Windows
to transparently perform NTLM authentication and disclose the
user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash
can potentially be brute-forced to recover the user's credentials.
This is addressed by limiting the bundle URIs that git clone
respects by the same protocol.<name>.allow rules as usual, which
excludes file:// URIs by default.
Johannes Schindelin (dscho)
requested a review
from Matthew John Cheetham (mjcheetham)
August 11, 2026 18:13
Johannes Schindelin (dscho)
enabled auto-merge
August 11, 2026 18:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See https://github.com/microsoft/git/releases/tag/v2.55.0.vfs.0.8.