All Git users using should update their git clients asap for OS X and Windows (but not typical UNIX users, some Linux machines may be affected also). This fix address the "git crit" security bug.
2014-12-19 - CVE-2014-9390 security fix
http://www.phoronix.com/scan.php?page=news_item&px=MTg2ODA
http://article.gmane.org/gmane.linux.kernel/1853266
http://www.infoq.com/news/2014/12/git-vulnerability-osx-windows
Mac (OS X) instructions:
If you are an existing OpenPlex user (or not) you need to install this .dmg to fix it and update your github client(s) (if used) or use this app I made to automate the process:
The app I made installs git 2.2.1, fixes the proper paths for git, and check for running version of git:
#Easy method
GIT CRIT FIX APP <-----------If this app works for you PLEASE provide the OS X version it worked on. Your feedback is greatly appreciated, thanks!
App so far sucessfully tested on 10.7, 10.9, & 10.10
#Manual Method
- 10.6 Snow Leopard: git-*-snow-leopard
- 10.7 Lion: git-*-snow-leopard
- 10.8 Mountain Lion: git-*-snow-leopard
- 10.9 Mavericks: git-*-mavericks
- 10.10 Yosemite: git-*-mavericks
Download the proper git.dmg here:
http://sourceforge.net/projects/git-osx-installer/files/
You can test you are using the correct git by typing this in terminal:
which git
If you installed the above .dmg and it says:
/usr/local/git/bin/git
You are all set. If not open terminal and type this:
cd /etc; sudo nano paths
Add this line to the top of the rest of paths:
/usr/local/git/bin
Press Control+o (to save) then Control+x to (exit)
quit terminal.app completely then open a new terminal then test git again by typing:
which git
OpenPlex 0.4 installs and corrects the "git crit" bug by default ONLY for new OpenPlex users only for the system used git not any other client(s).
Linux instructions:
Even though the issue may not affect Linux users, if you are a
hosting service whose users may fetch from your service to Windows
or Mac OS X machines, you are strongly encouraged to update to
protect such users who use existing versions of Git.
Windows instructions:
Looks like 1.9.5 address the issue. Not sure how to check on windows to ensure its patched.
https://github.com/blog/1938-git-client-vulnerability-announced
http://git-scm.com/download/win
