git-lfs-3.4.1-4.el9_5
エラータID: AXSA:2025-9577:01
リリース日:
2025/01/27 Monday - 10:48
題名:
git-lfs-3.4.1-4.el9_5
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Git LFS には、認証情報に埋め込まれた改行・復帰文字の
サニタイズを行わずにリモートホストに引き渡してしまう
問題があるため、リモートの攻撃者により、細工された
URL の送信を介して、Git の認証情報の不正な取得を可能
とする脆弱性が存在します。(CVE-2024-53263)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-53263
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.
追加情報:
N/A
ダウンロード:
SRPMS
- git-lfs-3.4.1-4.el9_5.src.rpm
MD5: 36676a481f18d1e6eae1b67dcce8eb8e
SHA-256: 187836b738e823a8ad2990201e57f43baef7e9b3fa746d6ae0b4566ed3d7741f
Size: 3.34 MB
Asianux Server 9 for x86_64
- git-lfs-3.4.1-4.el9_5.x86_64.rpm
MD5: 31a7626133f2ee6e810e3299cfa8af1e
SHA-256: 6e32204e51f113a25549725f2e04c3c41dc0837b30d05c41d6756f9b7b547a2c
Size: 4.29 MB
English