Red Hat 製品エラータ RHSA-2025:0845 - Security Advisory
発行日:
2025-01-30
更新日:
2025-01-30

RHSA-2025:0845 - Security Advisory

概要

Important: git-lfs security update

タイプ/重大度

Security Advisory: Important

Red Hat Insights パッチ分析

このアドバイザリーの影響を受けるシステムを特定し、修正します。

影響を受けるシステムの表示

トピック

An update for git-lfs is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

説明

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

  • git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解決策

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

影響を受ける製品

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

修正

  • BZ - 2338002 - CVE-2024-53263 git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs

Red Hat Enterprise Linux for x86_64 8

SRPM
git-lfs-3.4.1-4.el8_10.src.rpm SHA-256: 31b3e7ab67b62bced3346a0484bd01e54a5a24e8c2c9e56caeaf275ab390a476
x86_64
git-lfs-3.4.1-4.el8_10.x86_64.rpm SHA-256: d3e9ea139d0a2d85b68f65fe919066beed47a64af1bae8bcb051e4337bb2223b
git-lfs-debuginfo-3.4.1-4.el8_10.x86_64.rpm SHA-256: d4730dadfbff9afb611e2e3d4ce548f46a17fb4433a4aea6d6c71d9d4fe20a7e
git-lfs-debugsource-3.4.1-4.el8_10.x86_64.rpm SHA-256: 1539cd68e2728b053b8422c62c3e661124b702acdf3dea11aa0e4e42c6f6be13

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
git-lfs-3.4.1-4.el8_10.src.rpm SHA-256: 31b3e7ab67b62bced3346a0484bd01e54a5a24e8c2c9e56caeaf275ab390a476
s390x
git-lfs-3.4.1-4.el8_10.s390x.rpm SHA-256: 92c08fcd23d6280a3789122de0fb5a9bfc7a9ebd0ecbb130d299069ef1b36bba
git-lfs-debuginfo-3.4.1-4.el8_10.s390x.rpm SHA-256: 090d131acd96400f283b278054a6ee9903bf07c648e73853c4fe70b01785191d
git-lfs-debugsource-3.4.1-4.el8_10.s390x.rpm SHA-256: 2eb4e77dc0698481b1ae310b6b1dbfe5bd7534f188fb3012c06a15a48c9dbdff

Red Hat Enterprise Linux for Power, little endian 8

SRPM
git-lfs-3.4.1-4.el8_10.src.rpm SHA-256: 31b3e7ab67b62bced3346a0484bd01e54a5a24e8c2c9e56caeaf275ab390a476
ppc64le
git-lfs-3.4.1-4.el8_10.ppc64le.rpm SHA-256: e392833619f56f7b35e08ca56b70033b4b06106e8bf202ae286b869fd9ce3ff4
git-lfs-debuginfo-3.4.1-4.el8_10.ppc64le.rpm SHA-256: 79701e66b7e60dba3a817bf19b379115e95f17412e4b6a4e2edb84986b059f49
git-lfs-debugsource-3.4.1-4.el8_10.ppc64le.rpm SHA-256: 739a51308354308a4c44aeff1e80e99f825402bebe3698073afc8d6079209eae

Red Hat Enterprise Linux for ARM 64 8

SRPM
git-lfs-3.4.1-4.el8_10.src.rpm SHA-256: 31b3e7ab67b62bced3346a0484bd01e54a5a24e8c2c9e56caeaf275ab390a476
aarch64
git-lfs-3.4.1-4.el8_10.aarch64.rpm SHA-256: 0bb89d1041778d698a6b6c22ac8091b9b233933d4586f68c1421f0cd88e003d8
git-lfs-debuginfo-3.4.1-4.el8_10.aarch64.rpm SHA-256: cf6de43c69b7b253d85a7135337fb8a39d54f1e9ed9a53dd8a538f706863f3a1
git-lfs-debugsource-3.4.1-4.el8_10.aarch64.rpm SHA-256: 8689fd951518a024af2df99edc7a0c8bcae17a1dd5be69e2f52731b33240f9c2

Red Hat のセキュリティーに関する連絡先は secalert@redhat.com です。 連絡先の詳細は https://access.redhat.com/security/team/contact/ をご覧ください。