12661 matches found
Rocky Linux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779120418)
The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779120418 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates...
Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1776336504)
The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776336504 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...
AlmaLinux 9.2 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773314910)
The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773314910 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1773138498)
The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773138498 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2026_19350)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619350 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root...
CentOS Linux 8.5 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS8.5:CLSA-2025:1752656083)
The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1752656083 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)
The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...
AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1785421184)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785421184 advisory. - Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed,...
Rocky Linux 9 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (crlsa-2025_11462)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202511462 advisory. git: Git does not sanitize URLs when asking for credentials interactively CVE-2024-50349 git: Newline confusion in credential helpers can lead to credenti...
Rocky Linux 10.2 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2026_30855)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202630855 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...
Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2026_30853)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202630853 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the precedi...
Rocky Linux 9.2 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (ciqsa-2026_1470)
The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261470 advisory. This advisory aggregates security fixes for the git SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2025-27614, CVE-2024-52006. Tenable has extracted the...
Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2021_3074)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213074 advisory. nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl CVE-2021-23362 nodejs-ssri: Regular expression DoS ReDoS when...
Rocky Linux 9 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (crlsa-2024_4083)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244083 advisory. git: Recursive clones RCE CVE-2024-32002 git: RCE while cloning local repos CVE-2024-32004 git: additional local RCE CVE-2024-32465 git: insecure hardlinks...
CentOS Linux 8.5 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS8.5:CLSA-2025:1750352922)
The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1750352922 advisory. - Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported...
Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2021_3073)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213073 advisory. nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl CVE-2021-23362 nodejs-ssri: Regular expression DoS ReDoS when...
GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...
