This release introduces a security fix for Windows systems, which has been assigned CVE-2020-27955.

On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program is executed, permitting the attacker to execute arbitrary code. This security problem does not affect Unix systems.

This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. This has been solved by always using PATH to pre-resolve paths before handing them to Go.

We would like to extend a special thanks to the following open-source contributors:

• @dawidgolunski for reporting this to us responsibly

Bugs

• subprocess: avoid using relative program names (@bk2204)

Packages

Up to date packages are available on PackageCloud and Homebrew.

RPM RHEL 6/CentOS 6 RPM RHEL 7/CentOS 7 RPM RHEL 8/CentOS 8 Debian 8 Debian 9 Debian 10

SHA-256 hashes:

git-lfs-darwin-amd64-v2.12.1.zip df9321896c7537969911227d900861c6ca840b2f1ac5fd5c7e5deeb2bf9c2cbd

git-lfs-freebsd-386-v2.12.1.tar.gz 777374374a7fef476145e80b06f4a6d36022b7d7544c6c248ab6c3ed95261991

git-lfs-freebsd-amd64-v2.12.1.tar.gz b9149f4838ff65d96a47ce3adab119e6f8b91e6f75a320ab1ee3705f5711ba10

git-lfs-linux-386-v2.12.1.tar.gz 861f36921be0b206a0ad7b179ba6e595e8f32f9747541579bb3d7a54360798b5

git-lfs-linux-amd64-v2.12.1.tar.gz f1ad07284dfdefaca96fbd047b804dd95731332c90ae79acc30a5ab575a42c5c

git-lfs-linux-arm-v2.12.1.tar.gz 6b47a3e7104534616fc2ac6fa0ec400b0ec7de2c29f3ca9208079d3931d81389

git-lfs-linux-arm64-v2.12.1.tar.gz 53d6851160f71fdd0c243fc3435e8eec92b116d7a9ea30fa923eb533cbbd6052

git-lfs-linux-ppc64le-v2.12.1.tar.gz a738e35f102c1849d9e0565ac88aeb9d6797d7f9e9b8c5a082b9632a0ddf8169

git-lfs-linux-s390x-v2.12.1.tar.gz 3ca0262b1d3694445c9c7d668e225e191b25625ad1eadd6c6393ab19b65e33fd

git-lfs-v2.12.1.tar.gz 2b2e70f1233f7efe9a010771510391a07527ec7c0af721ecf8edabac5d60f62b

git-lfs-windows-386-v2.12.1.zip 246d6ad24ae6c89d88453dac50aa6ec991b0f09b21a72b56397c4ee3d795b2fc

git-lfs-windows-amd64-v2.12.1.zip 1243626c8b7d3607e1335c31cc00972e34904a568dcfb48e7c0f404877cceadc

git-lfs-windows-v2.12.1.exe 4a0118684f8e1445433a91a8ecd3176a201b5a90793f240fb9c61207fdb96e20

sha256sums.asc 24b9b046a8bb55a8e6daff2d7b8a465b87a8e3eca6453b616ef33a17b245fb0d