[ALSA-2022:7129] git-lfs security and bug fix update

Severity Moderate

Affected Packages 2

CVEs 9

git-lfs security and bug fix update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)
golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)
golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

git-lfs needs to be rebuild with golang 1.17.7-1 or above

Package	Affected Version
pkg:rpm/almalinux/git-lfs?arch=x86_64&distro=almalinux-8.6	< 2.13.3-3.el8_6
pkg:rpm/almalinux/git-lfs?arch=aarch64&distro=almalinux-8.6	< 2.13.3-3.el8_6

ID

ALSA-2022:7129

Severity

moderate

URL

https://errata.almalinux.org/ALSA-2022:7129.html

Published

2022-10-25T00:00:00
(23 months ago)

Modified

2022-10-27T09:34:45
(23 months ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2022:7129	https://access.redhat.com/errata/RHSA-2022:7129
CVE	CVE-2020-28851	https://access.redhat.com/security/cve/CVE-2020-28851
CVE	CVE-2020-28852	https://access.redhat.com/security/cve/CVE-2020-28852
CVE	CVE-2022-1705	https://access.redhat.com/security/cve/CVE-2022-1705
CVE	CVE-2022-27664	https://access.redhat.com/security/cve/CVE-2022-27664
CVE	CVE-2022-30630	https://access.redhat.com/security/cve/CVE-2022-30630
CVE	CVE-2022-30632	https://access.redhat.com/security/cve/CVE-2022-30632
CVE	CVE-2022-30635	https://access.redhat.com/security/cve/CVE-2022-30635
CVE	CVE-2022-32148	https://access.redhat.com/security/cve/CVE-2022-32148
CVE	CVE-2022-32189	https://access.redhat.com/security/cve/CVE-2022-32189
Bugzilla	1913333	https://bugzilla.redhat.com/1913333
Bugzilla	1913338	https://bugzilla.redhat.com/1913338
Bugzilla	2107371	https://bugzilla.redhat.com/2107371
Bugzilla	2107374	https://bugzilla.redhat.com/2107374
Bugzilla	2107383	https://bugzilla.redhat.com/2107383
Bugzilla	2107386	https://bugzilla.redhat.com/2107386
Bugzilla	2107388	https://bugzilla.redhat.com/2107388
Bugzilla	2113814	https://bugzilla.redhat.com/2113814
Bugzilla	2124669	https://bugzilla.redhat.com/2124669
Self	ALSA-2022:7129	https://errata.almalinux.org/8/ALSA-2022-7129.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:rpm/almalinux/git-lfs?arch=x86_64&distro=almalinux-8.6	almalinux	git-lfs	< 2.13.3-3.el8_6	almalinux-8.6	x86_64
Affected	pkg:rpm/almalinux/git-lfs?arch=aarch64&distro=almalinux-8.6	almalinux	git-lfs	< 2.13.3-3.el8_6	almalinux-8.6	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date