Add release notes for 2.13.12
Change-Id: I8522ef93ece6bf25659974d0d8b68fe6b7353a20
diff --git a/pages/site/releases/2.13.md b/pages/site/releases/2.13.md
index 6b743b7..8135960 100644
--- a/pages/site/releases/2.13.md
+++ b/pages/site/releases/2.13.md
@@ -6,7 +6,8 @@
toc: true
---
-Download: **[2.13.11](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.11.war)**
+Download: **[2.13.12](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.12.war)**
+| [2.13.11](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.11.war)
| [2.13.10](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.10.war)
| [2.13.9](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.9.war)
| [2.13.8](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.8.war)
@@ -19,7 +20,8 @@
| [2.13.1](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.1.war)
| [2.13](https://gerrit-releases.storage.googleapis.com/gerrit-2.13.war)
-Documentation: **[2.13.11](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.11/index.html)**
+Documentation: **[2.13.12](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.12/index.html)**
+| [2.13.11](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.11/index.html)
| [2.13.10](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.10/index.html)
| [2.13.9](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.9/index.html)
| [2.13.8](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.8/index.html)
@@ -409,6 +411,38 @@
## Bugfix Releases
+### 2.13.12
+
+* [Issue 10262](https://bugs.chromium.org/p/gerrit/issues/detail?id=10262):
+Fix validation of `wants` in `git-upload-pack` for protocol v0 bidirectional transports.
+
+ See the following section for details.
+
+* Upgrade JGit to 4.5.5.201812240535-r.
+
+ This upgrade includes several versions since 4.5.2 used in Gerrit
+ version 2.13.11. Important fixes are summarized below. Please refer to the
+ corresponding JGit release notes for full details.
+
+ * [JGit 4.5.5](https://projects.eclipse.org/projects/technology.jgit/releases/4.5.5):
+
+ * [Issue 10262](https://bugs.chromium.org/p/gerrit/issues/detail?id=10262):
+ Fix validation of `wants` in `git-upload-pack` for protocol v0 bidirectional transports.
+
+ AdvertiseRefsHook was not called for `git-upload-pack` in protocol v0
+ bidirectional transports, meaning that `wants` were not validated and
+ a user could fetch anything that is pointed to by any ref (using fetch-by-sha1),
+ as long as they could guess the object name.
+
+ * [JGit 4.5.4](https://projects.eclipse.org/projects/technology.jgit/releases/4.5.4):
+
+ * Fix LockFile semantics when running on NFS.
+ * Honor trustFolderStats also when reading packed-refs.
+
+ * [JGit 4.5.3](https://projects.eclipse.org/projects/technology.jgit/releases/4.5.3):
+
+ * Fix exception handling for opening bitmap index files.
+
### 2.13.11
* Upgrade jsch to 0.1.54 to fix [CVE-2016-5725](https://nvd.nist.gov/vuln/detail/CVE-2016-5725):
Directory traversal vulnerability.
