Red Hat Security Advisory: git-lfs security update

Fixed packages 3

Vulnerabilities 4

• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 4.3
  CVE-2023-45289

  Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

  When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will fo…

  Go standard library net/http net/http/cookiejar golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2724.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2023-45289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45289
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-24783
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24783
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24783
• advisory
  https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
• article
  https://go.dev/cl/569339
• article
  https://go.dev/issue/65390
• advisory
  https://pkg.go.dev/vuln/GO-2024-2598
• article
  https://security.netapp.com/advisory/ntap-20240329-0005