Important: git-lfs security update
Summary
ALSA-2024:2079: Important: git-lfs security update. Affects git-lfs versions < 3.2.0-2.el9_3. Fixed in 3.2.0-2.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is a tool that replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. It is widely used to manage and version control large files in software development projects.
Vulnerability Detail
The vulnerability (CVE-2023-45288) affects the net/http and x/net/http2 packages in the golang programming language. It allows an attacker to send an unlimited number of CONTINUATION frames, leading to a denial of service (DoS) attack. This vulnerability can be exploited to exhaust server resources and disrupt the availability of affected systems.
How To Fix
Minimum fixed version
3.2.0-2.el9_3
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the git-lfs package is vulnerable to a denial of service (DoS) attack due to a flaw in the net/http and x/net/http2 packages. It is crucial to update the git-lfs package to version 3.2.0-2.el9_3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is a tool that replaces large files with text pointers inside Git, while storing the actual file contents on a remote server. It helps manage and version control large files in software development projects.
The vulnerability allows an attacker to perform a denial of service (DoS) attack by sending an unlimited number of CONTINUATION frames. This can lead to resource exhaustion and disrupt the availability of affected systems.
The vulnerability affects the net/http and x/net/http2 packages in the golang programming language.
To fix this vulnerability, update the git-lfs package to version 3.2.0-2.el9_3 or later.
No workaround has been provided for this vulnerability. It is recommended to update the affected package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
