Hacker News new | ask | show | jobs
by adrianmonk 1251 days ago
> git 2.39.1 is already available on Ubuntu

The updater just gave me 1:2.37.2-1ubuntu1.2 (to replace 1:2.37.2-1ubuntu1.1). It said it addresses the two CVEs in question.

So they (Ubuntu or maybe Debian) are taking the approach of patching a slightly older git version.
1 comments
tomxor 1251 days ago
I'm not sure why they aren't bumping the patch number, maybe they decided against applying the other parts of the patch for least change - but at least the CVEs are mentioned in all of the Ubuntu changelogs.

I can't find anything in the Debian changelogs referring to the CVEs. Yet the Ubuntu changelog refers to it as a debian patch...

Anyone know anything about Debian?

link
foresto 1251 days ago
Looks like it's tracked in Debian, but not addressed yet.

https://security-tracker.debian.org/tracker/CVE-2022-23521

https://security-tracker.debian.org/tracker/CVE-2022-41903

https://www.debian.org/security/2023/

https://tracker.debian.org/pkg/git

link
tomxor 1250 days ago
Thank you!
link