And the announcement from the Git project is at https://marc.info/?l=git&m=152761328506724&w=2. See also CVE-2018-11233 and 11235.