Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Git LFS on Red Hat Systems Exposes Sensitive File Data

published 2 years ago

Summary

A security update is available for Git Large File Storage (LFS) on Red Hat systems. If not applied, attackers could potentially access sensitive file data. Update your systems to the latest version to mitigate this risk.

What to do

Update redhat git-lfs to version 0:3.2.0-3.el8_9.
Update redhat git-lfs-debuginfo to version 0:3.2.0-3.el8_9.
Update redhat git-lfs-debugsource to version 0:3.2.0-3.el8_9.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs	< 0:3.2.0-3.el8_9 Fix: upgrade to 0:3.2.0-3.el8_9
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs-debuginfo	< 0:3.2.0-3.el8_9 Fix: upgrade to 0:3.2.0-3.el8_9
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs-debugsource	< 0:3.2.0-3.el8_9 Fix: upgrade to 0:3.2.0-3.el8_9

Original advisory text

Red Hat Security Advisory: git-lfs security update

References

https://access.redhat.com/errata/RHSA-2024:2699 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2268273 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2699.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-45288 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-45288 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45288 Vendor Advisory
https://nowotarski.info/http2-continuation-flood/ Third Party Advisory
https://pkg.go.dev/vuln/GO-2024-2687 Vendor Advisory
https://www.kb.cert.org/vuls/id/421644 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published30 Sep 2024

Updated25 Apr 2026

First seen25 Apr 2026

Sources

RHSA-2024:2699 · OSV

Track software like this

Free during beta