Git for Windows ships with vulnerable Vim

[beevvy]

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options
git version 2.22.0.windows.1
cpu: x86_64
built from commit: d003d728ffa6c0006da875ec6318d3f6b28a4ddb
sizeof-long: 4
sizeof-size_t: 8

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

$ cmd.exe /c ver

Microsoft Windows [Version 10.0.18362.175]

• What options did you set as part of the installation? Or did you choose the
  defaults?

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt
Editor Option: VIM
Custom Editor Path:
Path Option: CmdTools
SSH Option: OpenSSH
CURL Option: WinSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Performance Tweaks FSCache: Enabled
Use Credential Manager: Enabled
Enable Symlinks: Disabled
Enable Builtin Interactive Add: Disabled

Details

Git for Windows ships with Vim 8.1.1234, which is vulnerable to arbitrary code execution via CVE-2019-12735. See https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md

It should be updated to 8.1.1365 or newer.

[PhilipOakley]

PR?
(i.e. it would be a great help if you could provide a Pull Request to update the packaging manifest in build-extra, as per previous updates of included packages)

[dscho]

The MSYS2 maintainer indicated that they are busy with some Qt packages. If that takes too long, I'll probably bundle a Git for Windows-only version of the newest vim package.

[dscho]

The next version (and the next snapshot) will have this update.