Important: git-lfs security update
Summary
ALSA-2024:2724: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-2.el9_4. Fixed in 3.4.1-2.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is a tool that replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. It is commonly used to manage large files in Git repositories.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the git-lfs package:
-
CVE-2023-45288: A flaw in the net/http and x/net/http2 packages in golang allows an attacker to cause a denial of service (DoS) by sending an unlimited number of CONTINUATION frames.
-
CVE-2023-45289: The net/http/cookiejar package in golang forwards sensitive headers and cookies on HTTP redirects, potentially exposing them to unauthorized parties.
-
CVE-2023-45290: A memory exhaustion vulnerability exists in the net/http package of golang, specifically in the Request.ParseMultipartForm function. An attacker can exploit this flaw to exhaust server memory resources.
-
CVE-2024-24783: The crypto/x509 package in golang panics when verifying certificates with an unknown public key algorithm.
These vulnerabilities could lead to various security issues, including DoS attacks, unauthorized access to sensitive information, and memory exhaustion.
How To Fix
Minimum fixed version
3.4.1-2.el9_4
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the git-lfs package to version 3.4.1-2.el9_4 or later to mitigate the identified security vulnerabilities. Failure to do so may expose your system to potential attacks and unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is a tool that replaces large files with text pointers in Git repositories, storing the actual file contents on a remote server. It helps manage large files efficiently.
These vulnerabilities can lead to denial of service (DoS) attacks, unauthorized access to sensitive information, and memory exhaustion on affected systems.
You can use the Vulert Playground at Vulert Scanner to check if your git-lfs package is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
No, there are no known workarounds for these vulnerabilities. It is recommended to update the git-lfs package to the latest version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
