UBUNTU-CVE-2024-53263
- Source
- https://ubuntu.com/security/CVE-2024-53263
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-53263.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-53263
- Related
- Published
- 2025-01-14T20:15:00Z
- Modified
- 2025-01-17T08:21:18Z
- Summary
- [none]
- Details
-
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the
git-credential(1)command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time. - References
-
- https://ubuntu.com/security/CVE-2024-53263
- https://www.cve.org/CVERecord?id=CVE-2024-53263
- https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7
- https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90
- https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1
Affected packages
Ubuntu:Pro:18.04:LTS / git-lfs
Package
- Name
- git-lfs
- Purl
- pkg:deb/ubuntu/git-lfs@2.3.4-1?arch=source&distro=esm-apps/bionic
Ubuntu:20.04:LTS / git-lfs
Package
- Name
- git-lfs
- Purl
- pkg:deb/ubuntu/git-lfs@2.9.2-1?arch=source&distro=focal
Ubuntu:22.04:LTS / git-lfs
Package
- Name
- git-lfs
- Purl
- pkg:deb/ubuntu/git-lfs@3.0.2-1ubuntu0.3?arch=source&distro=jammy
Ubuntu:24.10 / git-lfs
Package
- Name
- git-lfs
- Purl
- pkg:deb/ubuntu/git-lfs@3.5.0-1?arch=source&distro=oracular