The current Git version is 2.8.1. Xcode 7.3 comes with Git 2.6.4.<\/p>\n\n
Rachel Kroll<\/a> (via Hacker News<\/a>):<\/p>\n git 2.6.4. Is anything wrong with that? Well, yeah, actually. Say hello to CVE-2016-2324 and CVE-2016-2315, present in everything before 2.7.1 according to the report. You should check this out.<\/p>\n Remote. Code. Execution.<\/a><\/p>\n […]<\/p>\n Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. In short, you can’t just replace \/usr\/bin\/git.<\/p><\/blockquote>\n\n cs702<\/a>:<\/p>\n Companies like Apple and Microsoft prevent you from modifying the software installed on your computer to improve your security.<\/p>\n Ironically, when they do that, they also make it difficult, impractical, or impossible for you to upgrade or disable vulnerable software (in this case, an old, insecure version of git with remote-code-execution vulnerability).<\/p>\n<\/blockquote>\n\n joushou<\/a>:<\/p>\n \/usr\/bin\/git is a “toolshim” that effectively calls “xcrun git” (it actually calls xcselect_invoke_xcrun, from \/usr\/lib\/libxcselect.dylib, if you really want the details - this can be found by inspecting the binary). xcode-select’s manpage tells you that these shims call the respective binary in the active developer directory, whereas xcrun’s manpage describes its capabilities in more detail.<\/p><\/blockquote>\n\n fishywang<\/a>:<\/p>\n Imagine that you are a corp IT and managing a fleet of developers with Macs. You can push a newer version of git to them, and you can even change their default PATH so that the version of git you pushed are before the git comes with Apple. But you still cannot remove the one comes with Apple, and you cannot prevent it from being used.<\/p><\/blockquote>\n\n Update (2016-05-06): The updated version of Git is finally<\/a> in the release notes<\/a> for Xcode 7.3.1 (Hacker News<\/a>).<\/p>","protected":false},"excerpt":{"rendered":" The current Git version is 2.8.1. Xcode 7.3 comes with Git 2.6.4. Rachel Kroll (via Hacker News): git 2.6.4. Is anything wrong with that? Well, yeah, actually. Say hello to CVE-2016-2324 and CVE-2016-2315, present in everything before 2.7.1 according to the report. You should check this out. Remote. Code. Execution. […] Apple is doing something […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2021-09-27T19:51:28Z","apple_news_api_id":"c2f27588-ed9e-4cab-962f-6db04e6f37be","apple_news_api_modified_at":"2021-09-27T19:51:28Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/AwvJ1iO2eTKuWL22wTm83vg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,377,48,226],"class_list":["post-14218","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-git","tag-security","tag-xcode"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/14218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=14218"}],"version-history":[{"count":6,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/14218\/revisions"}],"predecessor-version":[{"id":33745,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/14218\/revisions\/33745"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=14218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=14218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=14218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n