Summary
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
* golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
* net/[http:](http:) Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | git-lfs | 3.6.1-1.el9 |
Vulnerabilities 6
-
Critical 9.8
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
-
High 7.5
Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…
-
Medium 6.5
Golang-fips: golang fips zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non…
-
Medium 5.9
Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
-
Unscored —
Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
-
Unscored —
Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …
References
-
report
https://access.redhat.com/security/cve/CVE-2023-39321
-
report
https://access.redhat.com/security/cve/CVE-2023-39322
-
report
https://access.redhat.com/security/cve/CVE-2024-24788
-
report
https://access.redhat.com/security/cve/CVE-2024-24790
-
report
https://access.redhat.com/security/cve/CVE-2024-24791
-
report
https://access.redhat.com/security/cve/CVE-2024-9355
-
report
https://bugzilla.redhat.com/2237777
-
report
https://bugzilla.redhat.com/2237778
-
report
https://bugzilla.redhat.com/2279814
-
report
https://bugzilla.redhat.com/2292787
-
report
https://bugzilla.redhat.com/2295310
-
report
https://bugzilla.redhat.com/2315719
-
advisory
https://errata.almalinux.org/9/ALSA-2025-7256.html