RHSA-2024:2724

Security

Issued at: 2024-05-07

Synopsis

Important: git-lfs security update

Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)

* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Red Hat Enterprise Linux for ARM 64 - 9 Red Hat Enterprise Linux for IBM z Systems - 9 Red Hat Enterprise Linux for Power, little endian - 9 Red Hat Enterprise Linux for x86_64 - 9

Fixes

2268017 2268018 2268019 2268273

CVEs

CVE-2023-45288 CVE-2023-45289 CVE-2023-45290 CVE-2024-24783

Affected packages

git-lfs-0:3.4.1-2.el9_4.aarch64 git-lfs-0:3.4.1-2.el9_4.ppc64le git-lfs-0:3.4.1-2.el9_4.s390x git-lfs-0:3.4.1-2.el9_4.src git-lfs-0:3.4.1-2.el9_4.x86_64 git-lfs-debuginfo-0:3.4.1-2.el9_4.aarch64 git-lfs-debuginfo-0:3.4.1-2.el9_4.ppc64le git-lfs-debuginfo-0:3.4.1-2.el9_4.s390x git-lfs-debuginfo-0:3.4.1-2.el9_4.x86_64 git-lfs-debugsource-0:3.4.1-2.el9_4.aarch64 git-lfs-debugsource-0:3.4.1-2.el9_4.ppc64le git-lfs-debugsource-0:3.4.1-2.el9_4.s390x git-lfs-debugsource-0:3.4.1-2.el9_4.x86_64