Moderate Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:7256: Moderate: git-lfs security update. Affects git-lfs versions < 3.6.1-1.el9. Fixed in 3.6.1-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality enables developers to work with large files without compromising the performance of their Git repositories. However, vulnerabilities in the underlying libraries can expose users to security risks.
Vulnerability Detail
The Git LFS package has been found to contain multiple vulnerabilities originating from its dependencies, particularly in the Go programming language libraries. These vulnerabilities include a panic when processing post-handshake messages on QUIC connections, a lack of limits on buffered post-handshake messages, and potential denial of service due to improper handling of HTTP 100-continue responses. If exploited, these vulnerabilities could lead to application crashes, infinite loops, or denial of service, impacting the availability and reliability of applications using Git LFS.
How To Fix
Minimum fixed version
3.6.1-1.el9
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to update to the patched version of Git LFS as soon as possible.
Conclusion
The Git LFS package has been identified with multiple vulnerabilities that could impact the security and stability of applications using it. It is imperative for users to update to the latest patched version to safeguard their systems against potential exploits. Regular monitoring and updates are essential to maintain security in open-source software.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers and storing the actual files on a remote server.
The vulnerabilities include panic on QUIC connections, lack of limits on buffered messages, malformed DNS message handling, and improper HTTP handling, among others.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is crucial to prioritize updating Git LFS to mitigate the risks associated with these vulnerabilities.
For detailed information about the security issues, including CVSS scores and acknowledgments, refer to the CVE pages listed in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
