[3.19] main/git: security upgrade to 2.43.4 (!65930) · Merge requests · alpine / aports · GitLab

GitLab now enforces expiry dates on tokens that originally had no set expiration date. Those tokens were given an expiration date of one year later. Please review your personal access tokens, project access tokens and group access tokens to ensure you are aware of upcoming expirations. Administrators of GitLab can find more information on how to identify and mitigate interruption, please take a look at our documentation.

Furkan Mustafa requested to merge furkanmustafa/aports-dev:3.19-security/git into 3.19-stable May 15, 2024

CVE-2024-32002 (Critical for case insensitive file systems with symlink support)
CVE-2024-32004 (High)
CVE-2024-32465 (High)
CVE-2024-32020 (Low)
CVE-2024-32021 (Low)

As always, it is best to avoid cloning repositories from untrusted sources.

More info; https://github.blog/2024-05-14-securing-git-addressing-5-new-vulnerabilities/

Upstream patched versions; v2.45.1 v2.44.1 v2.43.4 v2.42.2 v2.41.1 v2.40.2 v2.39.4

We probably should look into previous Alpine releases as well.