git large file storage project git large file storage vulnerabilities and exploits

(subscribe to this query)

409

VMScore

Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the malicious user to execute arbitrary code. This ...

Git Large File Storage Project Git Large File Storage

605

VMScore

GitHub Git LFS prior to 2.1.1 allows remote malicious users to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Git Large File Storage Project Git Large File Storage

392

VMScore

On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..exe` program will be executed, permitting the malicious user to execute arbitrary code. This does not affect Unix systems....

Git Large File Storage Project Git Large File Storage

896

VMScore

Git LFS 2.12.0 allows Remote Code Execution.

Git Large File Storage Project Git Large File Storage 2.12.0

21 Github repositories

NA

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an malicious user to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Golang Go

NA

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an malicious user to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Golang Go

NA

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Golang Go

NA

In net/http in Go prior to 1.18.6 and 1.19.x prior to 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Golang Go 1.19.0 Golang Go Fedoraproject Fedora 36 Fedoraproject Fedora 37

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook