CVE-2024-53263

Impact

When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.

Patches

This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1.

Workarounds

There are no workarounds known at this time.

References

• https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7
• https://nvd.nist.gov/vuln/detail/CVE-2024-53263
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53263
• https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1
• git-lfs/git-lfs@0345b6f816

For more information

If you have any questions or comments about this advisory:

• For general questions, start a discussion in the Git LFS discussion forum.
• For reports of additional vulnerabilities, please follow the Git LFS security reporting policy.

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

• CVE-2024-53263: fix issue where Git LFS could expose user credentials via URL- encoded control characters in host's URL

Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs

Git LFS permits exfiltration of credentials via crafted HTTP URLs. (CVE-2024-53263)

This update for git-lfs fixes the following issues:

Update to 3.6.1: (boo#1235876):

This release introduces a security fix for all platforms, which has been assigned CVE-2024-53263.

When requesting credentials from Git for a remote host, prior versions of Git LFS passed portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters, and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker might have been able to retrieve a user's Git credentials. Git LFS now prevents bare line feed (LF) characters from being included in the values sent to the git-credential(1) command, and also prevents bare carriage return (CR) characters from being included unless the credential.protectProtocol configuration option is set to a value equivalent to false.

• Bugs

  • Reject bare line-ending control characters in Git credential requests (@chrisd8088)

update to version 3.6.0:

• https://github.com/git-lfs/git-lfs/releases/tag/v3.6.0

update to 3.5.1:

• Build release assets with Go 1.21 #5668 (@bk2204)
• script/packagecloud: instantiate distro map properly #5662 (@bk2204)
• Install msgfmt on Windows in CI and release workflows #5666 (@chrisd8088)

update to version 3.4.1:

• https://github.com/git-lfs/git-lfs/releases/tag/v3.4.1

These are all security issues fixed in the git-lfs-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250115T172141-1.1 package on the GA media of openSUSE Tumbleweed.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
  • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
  • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
  • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
  • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
  • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
  • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
  • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
  • GO-2025-3422 CVE-2025-24354

• Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3372 CVE-2024-45339
  • GO-2025-3373 CVE-2024-45341
  • GO-2025-3383 CVE-2024-45340
  • GO-2025-3420 CVE-2024-45336
  • GO-2025-3421 CVE-2025-22865

• Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
  • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
  • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
  • GO-2025-3396 CVE-2024-52594
  • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
  • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
  • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
  • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
  • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
  • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

• Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
  • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
  • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
  • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
  • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

• Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
  • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
  • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
  • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79

Ryota K discovered that Git LFS may leak login credentials in certain instances due to failing to check for URL-encoded characters. An attacker could possibly use this issue to learn sensitive information. (CVE-2024-53263)

It was discovered that Git LFS could have its git lfs checkout and git lfs pull commands abused to write to any file on a user's system. An attacker could possibly use this issue to execute arbitrary code. This issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-26625)