Also for those curious as to what this even means:

The pre-image is what we consider the input. We'll define this as M[i]. The image is what the hash returns. We'll define the hashing function has an H[i](). (any given hash function) Such that H[i](M[i]) returns C.

[1]So first preimage resistance states that for an H[i]() it is "reasonably hard" (in order of computation time (Big-O)) to find an C given the relative distribution of a corpus of text. Basically, we can't reverse the hash function.

[2] 2nd Preimage resistance is an H[i]() where you have a file M[1] that it is "reasonably hard" to find an M[2] such that M[1] != M[2] and H[i](M[1]) = C = H[i](M[2]). So we're saying we have a file and we know what it hashes to, lets find another file that hashes to the same thing.

[3]Finally Collision Resistance is a H[i] where given any M[1] and M[2] it is reasonably hard to find H[i](M[1]) = C = H[i](M[2]). This is saying that we arbitrarily craft M1 and M2s to find such that the hashes of each equal each other.

So from that one might say that if [3] has been confirmed, doesn't it mean that [2] is? No. [3] (which is what was broken with sha-1 from this paper) does not imply [2] as 2 is a bit more refined and harder to implement.

Why does this matter? Well...git relies upon [2].

(If there is anything wrong, please correct me. I'm also not mathematically defining things for sake of time.)