Separate copies of the same tool
Git issued fixes for six vulnerabilities on November 10, including a flaw that could let a repository run code during a recursive clone. The current fixed release is 2.56.1. Six older maintenance lines also received fixes. For firms building software for clients, the reach of the release extends beyond the Git program a developer starts in a terminal. An application can ship its own copy, and automated services may process repositories on a customer’s behalf.
What the hosting provider had changed
GitHub said fixes were already in place on its main hosted service and Enterprise Cloud, including its data-residency offering. For customers running GitHub Enterprise Server, the company listed four available releases. Its announcement described patched Git versions for Actions and Codespaces as forthcoming, and desktop application releases as being coordinated. Those statements describe the rollout as of the announcement. They give administrators different evidence depending on which product processes a repository.
The client handoff
For a software consultancy handling a customer’s repository, one engagement can involve a developer workstation, a desktop interface and an automated build. A version check on the workstation answers only for the executable it checked. The service provider’s release statement answers a different question, as does the record of which application build the consultant received. The distinction matters even on supported maintenance lines, since Git published backports that allow customers to take fixes without moving every installation to 2.56.1.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
