CVE Vulnerabilities

CVE-2024-53263

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jan 14, 2025 | Modified: Jan 23, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.1 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Ubuntu
MEDIUM

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the hosts URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a users Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Red Hat Enterprise Linux 8 RedHat git-lfs-0:3.4.1-4.el8_10 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat git-lfs-0:2.13.3-3.el8_4.1 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat git-lfs-0:2.13.3-3.el8_4.1 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat git-lfs-0:2.13.3-3.el8_4.1 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat git-lfs-0:2.13.3-3.el8_6.3 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat git-lfs-0:2.13.3-3.el8_6.3 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat git-lfs-0:2.13.3-3.el8_6.3 *
Red Hat Enterprise Linux 8.8 Extended Update Support RedHat git-lfs-0:3.2.0-2.el8_8.3 *
Red Hat Enterprise Linux 9 RedHat git-lfs-0:3.4.1-4.el9_5 *
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions RedHat git-lfs-0:2.13.3-5.el9_0.3 *
Red Hat Enterprise Linux 9.2 Extended Update Support RedHat git-lfs-0:3.2.0-2.el9_2.2 *
Red Hat Enterprise Linux 9.4 Extended Update Support RedHat git-lfs-0:3.4.1-4.el9_4.1 *

Potential Mitigations

References