Skip to content
OpenAdvisories
High ELSA-2025-0673 1 CVE

Important: git-lfs security update (Oracle Linux 9)

Published Jan 23, 2025 · Updated Jan 23, 2025

Ecosystem: Oracle Linux

Summary

[3.4.1-4]
- Backport CVE-2024-53263 fixes
- Resolves: RHEL-73936

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 git-lfs 0:3.4.1-4.el9_5

Vulnerabilities 1

  • High 8.5
    CVE-2024-53263

    Git LFS permits exfiltration of credentials via crafted HTTP URLs

    Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then…

    git-lfs git-lfs git-lfs github.com/git-lfs/git-lfs Debian Ubuntu Azure Linux Go