Moderate: git-lfs security and bug fix update
Summary
ALSA-2022:7129: Moderate: git-lfs security and bug fix update. Affects git-lfs versions < 2.13.3-3.el8_6. Fixed in 2.13.3-3.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is a tool that replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. It provides a way to manage large files efficiently within a Git repository. However, the git-lfs package is vulnerable to multiple security issues.
Vulnerability Detail
The git-lfs package is affected by several security vulnerabilities:
- CVE-2020-28851: This vulnerability can lead to a panic in language.ParseAcceptLanguage while parsing the -u- extension.
- CVE-2020-28852: This vulnerability can cause a panic in language.ParseAcceptLanguage while processing a bcp47 tag.
- CVE-2022-1705: The package has improper sanitization of the Transfer-Encoding header in the net/http module.
- CVE-2022-27664: The net/http module does not handle server errors properly after sending GOAWAY.
- CVE-2022-30630: The io/fs module is vulnerable to stack exhaustion in the Glob function.
- CVE-2022-30632: The path/filepath module is vulnerable to stack exhaustion in the Glob function.
- CVE-2022-30635: The encoding/gob module is vulnerable to stack exhaustion in the Decoder.Decode function.
- CVE-2022-32148: The net/http/httputil module has a flaw in the NewSingleHostReverseProxy function where it omits X-Forwarded-For.
- CVE-2022-32189: The math/big module can panic if decoding big.Float and big.Rat types with an encoded message that is too short, potentially leading to a denial of service.
These vulnerabilities can have various impacts, including panics, denial of service, and improper handling of server errors.
How To Fix
Minimum fixed version
2.13.3-3.el8_6
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The git-lfs package is affected by multiple security vulnerabilities that can have various impacts. To mitigate these vulnerabilities, it is recommended to update the package to version 2.13.3-3.el8_6 or above. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git Large File Storage (LFS) is a tool that replaces large files with text pointers inside Git, while storing the file contents on a remote server. It helps manage large files efficiently within a Git repository.
These vulnerabilities can lead to panics, denial of service, and improper handling of server errors.
To fix these vulnerabilities, update the git-lfs package to version 2.13.3-3.el8_6 or above.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
