git-lfs security update

3.4.1-4 - Backport CVE-2024-53263 fixes - Resolves: RHEL-73936...

RHEL 9 : git-lfs (RHSA-2025:0673)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0673 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing th...

Fedora 41 : git-lfs (2025-1de066b8af)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1de066b8af advisory. Update to latest version Fix CVE-2024-53263 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Debian: Security Advisory (DLA-4028-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4028-1] git-lfs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4028-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura January 22, 2025 https://wiki.debian.org/LTS -...

Debian dla-4028 : git-lfs - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4028 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4028-1 [email protected] https://www.debian.org/lts/security/...

Credentials Exposure

github.com/git-lfs/git-lfs is vulnerable to Credential Exposure. The vulnerability is due to improper handling of URL-encoded control characters in Git LFS, which passes portions of a host's URL containing embedded line-ending control characters e.g., LF or CR to the git-credential command withou...

SUSE CVE-2024-53263

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

git-lfs-3.6.1-1.1 on GA media (moderate)

git-lfs-3.6.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14649-1 Rating: moderate Cross-References: CVE-2024-53263 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the git-lfs-3.6.1-1.1...

GO-2025-3390 Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs

Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs...

OPENSUSE-SU-2025:14649-1 git-lfs-3.6.1-1.1 on GA media

These are all security issues fixed in the git-lfs-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-53263

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Gi...

Git LFS permits exfiltration of credentials via crafted HTTP URLs

Impact When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host...

AZL-55670 CVE-2024-53263 affecting package git-lfs for versions less than 3.6.1-1

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

CVE-2024-53263

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

DEBIAN-CVE-2024-53263

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

UBUNTU-CVE-2024-53263

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

CVE-2024-53263 Git LFS permits exfiltration of credentials via crafted HTTP URLs

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

CVE-2024-53263

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the "git-credential1" command without checking for embedded line-ending control characters, and then sends any credentials it receives back...

CVE-2024-53263 Git LFS permits exfiltration of credentials via crafted HTTP URLs

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...