CVE-2024-53263

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.

An update that fixes one vulnerability is now available. This update for git-lfs fixes the following issues. This release introduces a security fix for all platforms, which has been assigned CVE-2024-53263. When requesting credentials from Git for a remote host, prior versions of Git LFS passed portions of the host's URL to the git-credential command without checking for embedded line-ending control characters, and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed or carriage return characters into the URL, an attacker might have been able to retrieve a user's Git credentials. Git LFS now prevents bare line feed characters from being included in the values sent to the git-credential command, and also prevents bare carriage return characters from being included unless the credential.protectProtocol configuration option is set to a value equivalent to false.