This is an older version. The current version is 2.56.0.3. Git 2.56.0.3 · Released:
Installer files 2.47.1.2
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | EXE (Inno Setup) | Current user | — | github.com | VirusTotal |
| 64-bit | EXE (Inno Setup) | All users | — | github.com | VirusTotal |
| ARM64 | EXE (Inno Setup) | Current user | — | github.com | VirusTotal |
| ARM64 | EXE (Inno Setup) | All users | — | github.com | VirusTotal |
| 32-bit | EXE (Inno Setup) | Current user | — | github.com | VirusTotal |
| 32-bit | EXE (Inno Setup) | All users | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
Changes since Git for Windows v2.47.1 (November 25th 2024)
New Features
- Comes with Git Credential Manager v2.6.1, addressing CVE-2024-50338.
- Comes with Git LFS v3.6.1, addressing CVE-2024-53263.
Bug Fixes
- CVE-2024-50338: Git Credential Manager can be tricked to exfiltrate credentials for a trusted site to an untrusted site. Since the URLs needed for such an attack look suspicious, this usually requires a recursive clone or fetch.
- CVE-2024-53263: In conjunction with CVE-2024-52006, Git LFS can be tricked to exfiltrate credentials for a trusted site to an untrusted site.
- CVE-2024-50349: When prompting the user for a password in the terminal, Git does not neutralize control characters.
- CVE-2024-52005: The sideband channel does not neutralize control characters.
- CVE-2024-52006: Similar to CVE-2020-5260, affecting credential helpers that interpret Carriage Returns as newlines.https://github.com/git-for-windows/git/releases/tag/v2.47.1.windows.2
