Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0845 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0673 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git-lfs installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53263 advisory.

  - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a     remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for     embedded line-ending control characters, and then sends any credentials it receives back from the Git     credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF)     or carriage return (CR) characters into the URL, an attacker May be able to retrieve a user's Git     credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should     upgrade to v3.6.1. There are no workarounds known at this time. (CVE-2024-53263)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0297-1 advisory.

    - Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
      * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
      * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
      * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
      * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
      * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
      * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
      * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
      * GO-2025-3422 CVE-2025-24354

    - Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3372 CVE-2024-45339
      * GO-2025-3373 CVE-2024-45341
      * GO-2025-3383 CVE-2024-45340
      * GO-2025-3420 CVE-2024-45336
      * GO-2025-3421 CVE-2025-22865

    - Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
      * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
      * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
      * GO-2025-3396 CVE-2024-52594
      * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
      * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
      * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
      * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
      * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
      * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

    - Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
      * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
      * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
      * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
      * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

    - Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
      * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
      * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
      * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git-lfs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53263 advisory.

  - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a     remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for     embedded line-ending control characters, and then sends any credentials it receives back from the Git     credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF)     or carriage return (CR) characters into the URL, an attacker May be able to retrieve a user's Git     credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should     upgrade to v3.6.1. There are no workarounds known at this time. (CVE-2024-53263)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:0845 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-0845 advisory.

    - Backport CVE-2024-53263 fixes

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0845 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0825 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0759 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0758 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0757 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0765 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0762 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5849 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5849-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     January 24, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : git-lfs     CVE ID         : CVE-2024-53263

    It was discovered that Git LFS, a Git extension for versioning large     files, could leak authentication credentials in some setups.

    For the stable distribution (bookworm), this problem has been fixed in     version 3.3.0-1+deb12u1.

    We recommend that you upgrade your git-lfs packages.

    For the detailed security status of git-lfs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git-lfs

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:0673 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-0673 advisory.

    - Backport CVE-2024-53263 fixes

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-50deb0acd5 advisory.

    Update to latest version

    Fix CVE-2024-53263

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1de066b8af advisory.

    Update to latest version

    Fix CVE-2024-53263

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0673 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4028 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4028-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 22, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : git-lfs     Version        : 2.13.2-1+deb11u1     CVE ID         : CVE-2024-53263     Debian Bug     : 1093048

    CVE-2024-53263

        When Git LFS requests credentials from Git for a remote host, it         passes portions of the host's URL to the `git-credential(1)` command         without checking for embedded line-ending control characters, and then         sends any credentials it receives back from the Git credential helper         to the remote host. By inserting URL-encoded control characters such         as line feed (LF) or carriage return (CR) characters into the URL,         an attacker may be able to retrieve a user's Git credentials.

    For Debian 11 bullseye, this problem has been fixed in version     2.13.2-1+deb11u1.

    We recommend that you upgrade your git-lfs packages.

    For the detailed security status of git-lfs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git-lfs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216312	RockyLinux 8 : git-lfs (RLSA-2025:0845)	Nessus	Rocky Linux Local Security Checks	high
216310	RockyLinux 9 : git-lfs (RLSA-2025:0673)	Nessus	Rocky Linux Local Security Checks	high
215535	Azure Linux 3.0 Security Update: git-lfs (CVE-2024-53263)	Nessus	Azure Linux Local Security Checks	high
215217	Photon OS 4.0: Git PHSA-2025-4.0-0745	Nessus	PhotonOS Local Security Checks	high
215209	Photon OS 5.0: Git PHSA-2025-5.0-0463	Nessus	PhotonOS Local Security Checks	high
214906	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0297-1)	Nessus	SuSE Local Security Checks	high
214864	CBL Mariner 2.0 Security Update: git-lfs (CVE-2024-53263)	Nessus	MarinerOS Local Security Checks	high
214853	AlmaLinux 8 : git-lfs (ALSA-2025:0845)	Nessus	Alma Linux Local Security Checks	high
214825	Oracle Linux 8 : git-lfs (ELSA-2025-0845)	Nessus	Oracle Linux Local Security Checks	high
214808	RHEL 8 : git-lfs (RHSA-2025:0845)	Nessus	Red Hat Local Security Checks	high
214795	RHEL 8 : git-lfs (RHSA-2025:0825)	Nessus	Red Hat Local Security Checks	high
214722	RHEL 9 : git-lfs (RHSA-2025:0759)	Nessus	Red Hat Local Security Checks	high
214721	RHEL 9 : git-lfs (RHSA-2025:0758)	Nessus	Red Hat Local Security Checks	high
214720	RHEL 9 : git-lfs (RHSA-2025:0757)	Nessus	Red Hat Local Security Checks	high
214719	RHEL 8 : git-lfs (RHSA-2025:0765)	Nessus	Red Hat Local Security Checks	high
214717	RHEL 8 : git-lfs (RHSA-2025:0762)	Nessus	Red Hat Local Security Checks	high
214665	Debian dsa-5849 : git-lfs - security update	Nessus	Debian Local Security Checks	high
214646	AlmaLinux 9 : git-lfs (ALSA-2025:0673)	Nessus	Alma Linux Local Security Checks	high
214598	Oracle Linux 9 : git-lfs (ELSA-2025-0673)	Nessus	Oracle Linux Local Security Checks	high
214567	Fedora 40 : git-lfs (2025-50deb0acd5)	Nessus	Fedora Local Security Checks	high
214566	Fedora 41 : git-lfs (2025-1de066b8af)	Nessus	Fedora Local Security Checks	high
214545	RHEL 9 : git-lfs (RHSA-2025:0673)	Nessus	Red Hat Local Security Checks	high
214502	Debian dla-4028 : git-lfs - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-53263

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high