Source: git-lfs Version: 3.5.0-1 Severity: grave Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 3.3.0-1 Control: found -1 2.13.2-1
Hi, The following vulnerability was published for git-lfs. CVE-2024-53263[0]: | Git LFS is a Git extension for versioning large files. When Git LFS | requests credentials from Git for a remote host, it passes portions | of the host's URL to the `git-credential(1)` command without | checking for embedded line-ending control characters, and then sends | any credentials it receives back from the Git credential helper to | the remote host. By inserting URL-encoded control characters such as | line feed (LF) or carriage return (CR) characters into the URL, an | attacker may be able to retrieve a user's Git credentials. This | problem exists in all previous versions and is patched in v3.6.1. | All users should upgrade to v3.6.1. There are no workarounds known | at this time. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-53263 https://www.cve.org/CVERecord?id=CVE-2024-53263 [1] https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7 [2] https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90 Regards, Salvatore
