Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Git LFS for Red Hat may run attacker code

published 1 month ago

Summary

The Git Large File Storage (Git LFS) packages for Red Hat can be tricked into executing code supplied by an attacker. This could let a malicious user run programs on your server with the same rights as the Git LFS process. Update the Git LFS packages to the latest version provided by Red Hat as soon as possible.

What to do

Update redhat git-lfs to version 0:3.4.1-13.el8_10.
Update redhat git-lfs-debuginfo to version 0:3.4.1-13.el8_10.
Update redhat git-lfs-debugsource to version 0:3.4.1-13.el8_10.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs	< 0:3.4.1-13.el8_10 Fix: upgrade to 0:3.4.1-13.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs-debuginfo	< 0:3.4.1-13.el8_10 Fix: upgrade to 0:3.4.1-13.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	git-lfs-debugsource	< 0:3.4.1-13.el8_10 Fix: upgrade to 0:3.4.1-13.el8_10

Original advisory text

Red Hat Security Advisory: git-lfs security update

References

https://access.redhat.com/errata/RHSA-2026:67161 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67161.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33818 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33818 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 Vendor Advisory
https://go.dev/cl/814980 Third Party Advisory
https://go.dev/issue/80405 Third Party Advisory
https://groups.google.com/g/golang-announce/c/94pEornpRlI Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5972 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56860 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56860 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 Vendor Advisory
https://go.dev/cl/803681 Third Party Advisory
https://go.dev/issue/80494 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6218 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-56862 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56862 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 Vendor Advisory
https://go.dev/cl/804261 Third Party Advisory
https://go.dev/issue/80528 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-6090 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published14 Sep 2026

Updated14 Sep 2026

First seen14 Sep 2026

Sources

RHSA-2026:67161 · OSV

Track software like this

Free during beta