git-lfs-3.4.1-1.el9

エラータID: AXSA:2024-7894:02

リリース日: 
2024/05/30 Thursday - 11:43
題名: 
git-lfs-3.4.1-1.el9
影響のあるチャネル: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

Description:

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288,VU#421644.3)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2023-45288:
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

解決策: 

Update packages.

追加情報: 

N/A

ダウンロード: 

SRPMS
  1. git-lfs-3.4.1-1.el9.src.rpm
    MD5: be2d3f1c966d965f6e60da9594f9bfbb
    SHA-256: b018aaff3a4ffcf4758031868379aeeab35dd6e39e5dfaf460cd8d817910ce70
    Size: 3.33 MB

Asianux Server 9 for x86_64
  1. git-lfs-3.4.1-1.el9.x86_64.rpm
    MD5: 71f854a61f02ed65c481ebde291758fd
    SHA-256: 819c6248f6fc9ad434c4ea118447503519babf9beedb7814a9d9878b56887e6e
    Size: 4.18 MB