Concourse v5.5.7 Release Notes
Release Date: 2019-12-19 // over 4 years ago-
๐ ๐ security
- ๐ Updates the git resource to v1.6.3 to address a recently reported security vulnerability:
- CVE-2019-19604:
- Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
๐ฑ ๐ fix
0๏ธโฃ @vito bumped the
autocert
dependency so that Let's Encrypt will default to the ACME v2 API. #49120๏ธโฃ > Note: This backported fix includes the bump to the default value, which was
originally a follow-up patch in v5.7.3.
- ๐ Updates the git resource to v1.6.3 to address a recently reported security vulnerability: