Git LFS v2.1.1 ships with bug fixes and a security patch fixing a remote code
execution vulnerability exploitable by setting a SSH remote via your
repository's .lfsconfig to contain the string "-oProxyCommand". This
vulnerability is only exploitable if an attacker has write access to your
repository, or you clone a repository with a .lfsconfig file containing that
string.
Bugs
- Make pull return non-zero error code when some downloads failed #2245 (@seth2810, @technoweenie)
- lfsapi: support cross-scheme redirection #2243 (@ttaylorr)
- sanitize ssh options parsed from ssh:// url #2242 (@technoweenie)
- filepathfilter: interpret as .gitignore syntax #2238 (@technoweenie)
- tq/basic_download: guard against nil HTTP response #2229 (@ttaylorr)
- commands: fix logged error not interpolating format qualifiers #2230 (@ttaylorr)
Misc
- release: backport Debian 9-related changes #2244 (@ssgelm, @andyneff, @ttaylorr)
- Add git-lfs-lock and git-lfs-unlock to help index #2240 (@dpursehouse)
- config: allow multiple environments when calling config.Unmarshal #2224 (@ttaylorr)
Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 6/CentOS 6
RPM RHEL 7/CentOS 7
Debian 7
Debian 8
Debian 9
SHA-256 hashes
git-lfs-darwin-386-2.1.1.tar.gz
b06f107e565d280b9a48f94ab7c8449209a941ac4b994914885b4249974cb472
git-lfs-darwin-amd64-2.1.1.tar.gz
acefceb077d77d69e35f0017de91b8ea42cf980315226446b5c1dcafd9328e53
git-lfs-freebsd-386-2.1.1.tar.gz
940846cd30092b2741cc893692da0331ed85a5a2cd50b3d8493db5dc18c84b65
git-lfs-freebsd-amd64-2.1.1.tar.gz
b3765e44399b0a5007de724c056028ba390d81cca724c23dc206b5d12389d2bb
git-lfs-linux-386-2.1.1.tar.gz
72d29fede666c8e01100b5cd7b2015a2d2dc2e65d20777ca806fa72d4c1ea568
git-lfs-linux-amd64-2.1.1.tar.gz
ee41f7aa2e860ab2abf065bef71e7344b9777c5da25cde8a36891e4d8eb2bbdf
git-lfs-windows-2.1.1.exe
0f70b16ba9a42fab51c72a1a8e02a30971bc6921f485fb940547b41eab3dc7dd
git-lfs-windows-386-2.1.1.zip
897571c2b8aa777d011e7c5496735e9dcb2da809faa741b113169a5cb04650bd
git-lfs-windows-amd64-2.1.1.zip
0866259d6b097f8ff379326f798a93034b61952382011671b80ecf4cc733de57