Important: git-lfs security update
Summary
ALSA-2024:2699: Important: git-lfs security update. Affects git-lfs versions < 3.2.0-3.el8_9. Fixed in 3.2.0-3.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git Large File Storage (LFS) is a tool that replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. It is commonly used to manage large files in Git repositories.
Vulnerability Detail
The vulnerability identified in git-lfs is related to a security issue in the golang net/http and x/net/http2 packages. It allows an attacker to send an unlimited number of CONTINUATION frames, leading to a denial of service (DoS) attack. The impact of this vulnerability can result in resource exhaustion and disruption of service availability.
How To Fix
Minimum fixed version
3.2.0-3.el8_9
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is crucial to update the git-lfs package to version 3.2.0-3.el8_9 or later to mitigate the DoS vulnerability. Failure to do so may result in resource exhaustion and service disruption. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is a tool that replaces large files with text pointers in Git repositories, storing the actual file contents on a remote server. It helps manage large files efficiently.
The vulnerability allows an attacker to perform a denial of service attack by sending an unlimited number of CONTINUATION frames. This can lead to resource exhaustion and disruption of service availability.
You can use Vulert's playground at Vulert Scanner to check if your git-lfs package is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities.
No, there is no specific workaround available for this vulnerability. It is recommended to update the git-lfs package to the latest version.
You can refer to the CVE page(s) listed in the References section of the vulnerability details for more information about the impact, CVSS score, acknowledgments, and related information.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
