Red Hat Product Errata RHSA-2024:7136 - Security Advisory
Issued:
2024-09-25
Updated:
2024-09-25

RHSA-2024:7136 - Security Advisory

Synopsis

Important: git-lfs security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for git-lfs is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

  • encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

  • BZ - 2310528 - CVE-2024-34156 encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

Red Hat Enterprise Linux for x86_64 9

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux Server - AUS 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
s390x
git-lfs-3.4.1-4.el9_4.s390x.rpm SHA-256: 60b0c068f8c756fcaeba5e7ad75ea2c2e74219e71b2d2455f52264347b2ea2fc
git-lfs-debuginfo-3.4.1-4.el9_4.s390x.rpm SHA-256: 9df2335aea4d1d816f1b63671decd9cd6bbcab023c65644cfd7ba2eeee42d177
git-lfs-debugsource-3.4.1-4.el9_4.s390x.rpm SHA-256: 466cac66d1f903e4fa8d13e77f422470d852d89f56e2d78468e314e155246249

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
s390x
git-lfs-3.4.1-4.el9_4.s390x.rpm SHA-256: 60b0c068f8c756fcaeba5e7ad75ea2c2e74219e71b2d2455f52264347b2ea2fc
git-lfs-debuginfo-3.4.1-4.el9_4.s390x.rpm SHA-256: 9df2335aea4d1d816f1b63671decd9cd6bbcab023c65644cfd7ba2eeee42d177
git-lfs-debugsource-3.4.1-4.el9_4.s390x.rpm SHA-256: 466cac66d1f903e4fa8d13e77f422470d852d89f56e2d78468e314e155246249

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
s390x
git-lfs-3.4.1-4.el9_4.s390x.rpm SHA-256: 60b0c068f8c756fcaeba5e7ad75ea2c2e74219e71b2d2455f52264347b2ea2fc
git-lfs-debuginfo-3.4.1-4.el9_4.s390x.rpm SHA-256: 9df2335aea4d1d816f1b63671decd9cd6bbcab023c65644cfd7ba2eeee42d177
git-lfs-debugsource-3.4.1-4.el9_4.s390x.rpm SHA-256: 466cac66d1f903e4fa8d13e77f422470d852d89f56e2d78468e314e155246249

Red Hat Enterprise Linux for Power, little endian 9

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
ppc64le
git-lfs-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 8f588e46d6fe6f22a4c644fc10ba88fd1196f2556906c9e8b259b7c0be7f7cdb
git-lfs-debuginfo-3.4.1-4.el9_4.ppc64le.rpm SHA-256: d3c052f1e62a40f66698e4c374bc7a48ab852cea82c150db4840578117fa1c6c
git-lfs-debugsource-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 88c35cc21f623e858dfd64ad0e829b576189a5a30d54384f37ad654b2f226bbc

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
ppc64le
git-lfs-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 8f588e46d6fe6f22a4c644fc10ba88fd1196f2556906c9e8b259b7c0be7f7cdb
git-lfs-debuginfo-3.4.1-4.el9_4.ppc64le.rpm SHA-256: d3c052f1e62a40f66698e4c374bc7a48ab852cea82c150db4840578117fa1c6c
git-lfs-debugsource-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 88c35cc21f623e858dfd64ad0e829b576189a5a30d54384f37ad654b2f226bbc

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
ppc64le
git-lfs-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 8f588e46d6fe6f22a4c644fc10ba88fd1196f2556906c9e8b259b7c0be7f7cdb
git-lfs-debuginfo-3.4.1-4.el9_4.ppc64le.rpm SHA-256: d3c052f1e62a40f66698e4c374bc7a48ab852cea82c150db4840578117fa1c6c
git-lfs-debugsource-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 88c35cc21f623e858dfd64ad0e829b576189a5a30d54384f37ad654b2f226bbc

Red Hat Enterprise Linux for ARM 64 9

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
aarch64
git-lfs-3.4.1-4.el9_4.aarch64.rpm SHA-256: 304a82726db8adc66f785d427b6e3492a4b3e597bb005370a7aa2dcc84027794
git-lfs-debuginfo-3.4.1-4.el9_4.aarch64.rpm SHA-256: 01b35e4ee3e00806c10d91ed62287e0fb6b14239f73ab3d6c26da599d2b128b2
git-lfs-debugsource-3.4.1-4.el9_4.aarch64.rpm SHA-256: 63b6cd4b3937788298f687681b841677a1dfae8f666a66647106a90acb352f42

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
aarch64
git-lfs-3.4.1-4.el9_4.aarch64.rpm SHA-256: 304a82726db8adc66f785d427b6e3492a4b3e597bb005370a7aa2dcc84027794
git-lfs-debuginfo-3.4.1-4.el9_4.aarch64.rpm SHA-256: 01b35e4ee3e00806c10d91ed62287e0fb6b14239f73ab3d6c26da599d2b128b2
git-lfs-debugsource-3.4.1-4.el9_4.aarch64.rpm SHA-256: 63b6cd4b3937788298f687681b841677a1dfae8f666a66647106a90acb352f42

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
aarch64
git-lfs-3.4.1-4.el9_4.aarch64.rpm SHA-256: 304a82726db8adc66f785d427b6e3492a4b3e597bb005370a7aa2dcc84027794
git-lfs-debuginfo-3.4.1-4.el9_4.aarch64.rpm SHA-256: 01b35e4ee3e00806c10d91ed62287e0fb6b14239f73ab3d6c26da599d2b128b2
git-lfs-debugsource-3.4.1-4.el9_4.aarch64.rpm SHA-256: 63b6cd4b3937788298f687681b841677a1dfae8f666a66647106a90acb352f42

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
ppc64le
git-lfs-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 8f588e46d6fe6f22a4c644fc10ba88fd1196f2556906c9e8b259b7c0be7f7cdb
git-lfs-debuginfo-3.4.1-4.el9_4.ppc64le.rpm SHA-256: d3c052f1e62a40f66698e4c374bc7a48ab852cea82c150db4840578117fa1c6c
git-lfs-debugsource-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 88c35cc21f623e858dfd64ad0e829b576189a5a30d54384f37ad654b2f226bbc

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
ppc64le
git-lfs-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 8f588e46d6fe6f22a4c644fc10ba88fd1196f2556906c9e8b259b7c0be7f7cdb
git-lfs-debuginfo-3.4.1-4.el9_4.ppc64le.rpm SHA-256: d3c052f1e62a40f66698e4c374bc7a48ab852cea82c150db4840578117fa1c6c
git-lfs-debugsource-3.4.1-4.el9_4.ppc64le.rpm SHA-256: 88c35cc21f623e858dfd64ad0e829b576189a5a30d54384f37ad654b2f226bbc

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
x86_64
git-lfs-3.4.1-4.el9_4.x86_64.rpm SHA-256: e3bcdeb6a2d514fad41ac6c46250d549817155576d3d12b5ece37d08b45d98eb
git-lfs-debuginfo-3.4.1-4.el9_4.x86_64.rpm SHA-256: 75fd21282cde99979f0e3671960f570c0ad5bd8e67e5d42520013339b5ec3014
git-lfs-debugsource-3.4.1-4.el9_4.x86_64.rpm SHA-256: 3eed48d98d886d40c6443b4eb012348602ba78722591090cdbd716294e6d9458

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
aarch64
git-lfs-3.4.1-4.el9_4.aarch64.rpm SHA-256: 304a82726db8adc66f785d427b6e3492a4b3e597bb005370a7aa2dcc84027794
git-lfs-debuginfo-3.4.1-4.el9_4.aarch64.rpm SHA-256: 01b35e4ee3e00806c10d91ed62287e0fb6b14239f73ab3d6c26da599d2b128b2
git-lfs-debugsource-3.4.1-4.el9_4.aarch64.rpm SHA-256: 63b6cd4b3937788298f687681b841677a1dfae8f666a66647106a90acb352f42

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
aarch64
git-lfs-3.4.1-4.el9_4.aarch64.rpm SHA-256: 304a82726db8adc66f785d427b6e3492a4b3e597bb005370a7aa2dcc84027794
git-lfs-debuginfo-3.4.1-4.el9_4.aarch64.rpm SHA-256: 01b35e4ee3e00806c10d91ed62287e0fb6b14239f73ab3d6c26da599d2b128b2
git-lfs-debugsource-3.4.1-4.el9_4.aarch64.rpm SHA-256: 63b6cd4b3937788298f687681b841677a1dfae8f666a66647106a90acb352f42

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
s390x
git-lfs-3.4.1-4.el9_4.s390x.rpm SHA-256: 60b0c068f8c756fcaeba5e7ad75ea2c2e74219e71b2d2455f52264347b2ea2fc
git-lfs-debuginfo-3.4.1-4.el9_4.s390x.rpm SHA-256: 9df2335aea4d1d816f1b63671decd9cd6bbcab023c65644cfd7ba2eeee42d177
git-lfs-debugsource-3.4.1-4.el9_4.s390x.rpm SHA-256: 466cac66d1f903e4fa8d13e77f422470d852d89f56e2d78468e314e155246249

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
git-lfs-3.4.1-4.el9_4.src.rpm SHA-256: c8c011992eb4a6ee9b5b092bfde434c6ca20816c944c32766e30f92d8a8fb2ad
s390x
git-lfs-3.4.1-4.el9_4.s390x.rpm SHA-256: 60b0c068f8c756fcaeba5e7ad75ea2c2e74219e71b2d2455f52264347b2ea2fc
git-lfs-debuginfo-3.4.1-4.el9_4.s390x.rpm SHA-256: 9df2335aea4d1d816f1b63671decd9cd6bbcab023c65644cfd7ba2eeee42d177
git-lfs-debugsource-3.4.1-4.el9_4.s390x.rpm SHA-256: 466cac66d1f903e4fa8d13e77f422470d852d89f56e2d78468e314e155246249

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.