The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006282 advisory.

    Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a     remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for     embedded line-ending control characters, and then sends any credentials it receives back from the Git     credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF)     or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git     credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should     upgrade to v3.6.1. There are no workarounds known at this time.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762867600 advisory.

  - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a     remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for     embedded line-ending control characters, and then sends any credentials it receives back from the Git     credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF)     or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git     credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should     upgrade to v3.6.1. There are no workarounds known at this time. (CVE-2024-53263)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4028 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4028-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 22, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : git-lfs     Version        : 2.13.2-1+deb11u1     CVE ID         : CVE-2024-53263     Debian Bug     : 1093048

    CVE-2024-53263

        When Git LFS requests credentials from Git for a remote host, it         passes portions of the host's URL to the `git-credential(1)` command         without checking for embedded line-ending control characters, and then         sends any credentials it receives back from the Git credential helper         to the remote host. By inserting URL-encoded control characters such         as line feed (LF) or carriage return (CR) characters into the URL,         an attacker may be able to retrieve a user's Git credentials.

    For Debian 11 bullseye, this problem has been fixed in version     2.13.2-1+deb11u1.

    We recommend that you upgrade your git-lfs packages.

    For the detailed security status of git-lfs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/git-lfs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0762 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0845 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7977-1 advisory.

    Ryota K discovered that Git LFS may leak login credentials in certain instances due to failing to check     for URL-encoded characters. An attacker could possibly use this issue to learn sensitive information.
    (CVE-2024-53263)

    It was discovered that Git LFS could have its git lfs checkout and git lfs pull commands abused to write     to any file on a user's system. An attacker could possibly use this issue to execute arbitrary code. This     issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-26625)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0759 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0825 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:0845 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0845 advisory.

    * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2025:0153-1 advisory.

    Update to 3.6.1: (boo#1235876):

      This release introduces a security fix for all platforms, which       has been assigned CVE-2024-53263.

      When requesting credentials from Git for a remote host, prior       versions of Git LFS passed portions of the host's URL to the       git-credential(1) command without checking for embedded       line-ending control characters, and then sent any credentials       received back from the Git credential helper to the remote host.
      By inserting URL-encoded control characters such as line feed       (LF) or carriage return (CR) characters into the URL, an attacker       might have been able to retrieve a user's Git credentials.
      Git LFS now prevents bare line feed (LF) characters from being       included in the values sent to the git-credential(1) command, and       also prevents bare carriage return (CR) characters from being       included unless the credential.protectProtocol configuration       option is set to a value equivalent to false.

      * Bugs

        - Reject bare line-ending control characters in Git credential           requests (@chrisd8088)

    update to version 3.6.0:

    - https://github.com/git-lfs/git-lfs/releases/tag/v3.6.0

    update to 3.5.1:

      * Build release assets with Go 1.21 #5668 (@bk2204)
      * script/packagecloud: instantiate distro map properly #5662         (@bk2204)
      * Install msgfmt on Windows in CI and release workflows         #5666 (@chrisd8088)

    update to version 3.4.1:

    - https://github.com/git-lfs/git-lfs/releases/tag/v3.4.1

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0019 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-53263:
    Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a     remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for     embedded line-ending control characters, and then sends any credentials it receives back from the Git     credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF)     or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git     credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should     upgrade to v3.6.1. There are no workarounds known at this time.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
303359	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: git-lfs (UTSA-2026-006282)	Nessus	Unity Linux Local Security Checks	2026/3/23	2026/3/23	high
360962	AlmaLinux 9.2 [TuxCare] Security Update: git-lfs (ALMALINUX9.2:CLSA-2025:1762867600)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
214502	Debian dla-4028 : git-lfs - security update	Nessus	Debian Local Security Checks	2025/1/22	2025/1/24	high
214717	RHEL 8 : git-lfs (RHSA-2025:0762)	Nessus	Red Hat Local Security Checks	2025/1/28	2025/6/5	high
214808	RHEL 8 : git-lfs (RHSA-2025:0845)	Nessus	Red Hat Local Security Checks	2025/1/30	2025/6/5	high
296749	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Git LFS vulnerabilities (USN-7977-1)	Nessus	Ubuntu Local Security Checks	2026/1/27	2026/1/27	high
214722	RHEL 9 : git-lfs (RHSA-2025:0759)	Nessus	Red Hat Local Security Checks	2025/1/28	2025/6/5	high
214795	RHEL 8 : git-lfs (RHSA-2025:0825)	Nessus	Red Hat Local Security Checks	2025/1/30	2025/6/5	high
214853	AlmaLinux 8 : git-lfs (ALSA-2025:0845)	Nessus	Alma Linux Local Security Checks	2025/1/31	2025/1/31	high
215209	Photon OS 5.0: Git PHSA-2025-5.0-0463	Nessus	PhotonOS Local Security Checks	2025/2/10	2026/10/14	high
216312	RockyLinux 8 : git-lfs (RLSA-2025:0845)	Nessus	Rocky Linux Local Security Checks	2025/2/14	2025/2/14	high
235779	openSUSE 15 Security Update : git-lfs (openSUSE-SU-2025:0153-1)	Nessus	SuSE Local Security Checks	2025/5/13	2025/5/13	high
236134	Alibaba Cloud Linux 3 : 0019: git-lfs (ALINUX3-SA-2025:0019)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
215217	Photon OS 4.0: Git PHSA-2025-4.0-0745	Nessus	PhotonOS Local Security Checks	2025/2/10	2026/11/2	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high