Moderate: git-lfs security and bug fix update
Summary
ALSA-2023:2357: Moderate: git-lfs security and bug fix update. Affects git-lfs versions < 3.2.0-1.el9. Fixed in 3.2.0-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is a tool that replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. It is commonly used to manage large files in Git repositories. The vulnerability affects the git-lfs package in AlmaLinux 9.
Vulnerability Detail
The vulnerability includes multiple security issues in various components of the golang package used by git-lfs. These issues range from improper sanitization of headers to stack exhaustion and memory growth vulnerabilities. An attacker could exploit these vulnerabilities to cause denial of service, excessive memory growth, or potentially execute arbitrary code. The impact and severity of each vulnerability vary, but they are collectively classified as moderate.
How To Fix
Minimum fixed version
3.2.0-1.el9
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the git-lfs package in AlmaLinux 9 is affected by multiple moderate security vulnerabilities. To mitigate these vulnerabilities, it is crucial to update the git-lfs package to version 3.2.0-1.el9 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is a tool that replaces large files with text pointers in Git repositories, storing the file contents on a remote server. It helps manage large files efficiently.
The update addresses multiple security issues, including improper sanitization of headers, stack exhaustion, memory growth, and potential denial of service vulnerabilities.
The impact varies for each vulnerability but can include denial of service, excessive memory growth, and potential execution of arbitrary code.
To fix the vulnerability, update the git-lfs package to version 3.2.0-1.el9 or later using the package manager command specific to AlmaLinux 9.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to apply the update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
