Azure-pipelines-agent: Update Agent to Latest Git Version 2.30.2

[ChristopherMank]

When could we expect to see the agent get bundled with the latest git version 2.30.2 that was just released on 3/9/21? Wanting to get the latest git vulnerabilities fixed in the agents. Thanks!

[james-flynn-ie]

There is a CVE for Git (https://nvd.nist.gov/vuln/detail/CVE-2021-21300) which is resolved in 2.30.2.

Can we get an urgent patch upgrade to resolve this vulnerability please, @anatolybolshakov ?

[ChristopherMank]

And actually Git 2.31.0 was just released. I'm assuming we'd go to the latest.

[james-flynn-ie]

Hi @EzzhevNikita , do you know when this update is likely to be released, please? It's a security vulnerability which we would urgently like to patch.

[EzzhevNikita]

Hi @james-flynn-ie, this update will be released during the next sprint, after about 4 - 5 weeks

[james-flynn-ie]

4-5 weeks for a security vulnerability fix seems a little long (the Git patch itself was released two weeks ago already). Do you guys have a process in place for security patches, @EzzhevNikita and @anatolybolshakov ?

[EzzhevNikita]

@james-flynn-ie We have revised our plans to deploy the current version of the agent, and have included this fix in it, the agent with the new version of the git will be available sometime early next week.

[james-flynn-ie]

@james-flynn-ie We have revised our plans to deploy the current version of the agent, and have included this fix in it, the agent with the new version of the git will be available sometime early next week.

That's great news, thank you for bringing forward the release, @EzzhevNikita ! 👍

[EzzhevNikita]

@james-flynn-ie @ChristopherMank Agent v2.184.2 which contains git version 2.30.2 has been deployed