git large file storage vulnerabilities and fixes

Recent CVEs affecting git large file storage, with upgrade or downgrade steps. 3 tracked.

Also searched as: gitlargefilestorage.

git large file storage has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-04-20. Highest priority: CVE-2020-27955 (score 69/100).

• CVE-2022-24826 CRITICAL 9.8 UPGRADE On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe
• CVE-2021-21237 HIGH 7.2 UPGRADE Git LFS is a command line extension for managing large files with Git
• CVE-2020-27955 CRITICAL 9.8 DOWNGRADE Git LFS 2.12.0 allows Remote Code Execution.

FAQ

How do I fix git large file storage vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is git large file storage being exploited right now?

None of the tracked git large file storage CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which git large file storage CVE should I patch first?

CVE-2020-27955 currently ranks highest (69/100): Git LFS 2.12.0 allows Remote Code Execution..

RSS feed for git large file storage · ← Back to latest CVEs