-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of newline characters in URLs when Git LFS interacts with Git credential helpers. The commit 0345b6f816e611d050c0df67b61f0022916a1c90 patches this vulnerability.
Creds.buffer method in creds/creds.go is directly responsible for constructing the data payload sent to the git-credential helper. The patch introduces a check (strings.Contains(item, "\n")) within this method to detect and reject credential values containing newline characters. Its previous lack of such a check made it vulnerable, as it would include raw newlines from crafted URLs in the output buffer.commandCredentialHelper.exec method in creds/creds.go is the caller of Creds.buffer and uses its output to set the standard input for the git-credential command. The patch modifies this method to handle the new error returned by Creds.buffer if a newline is detected. This implies that before the patch, it would use the potentially malicious buffer from Creds.buffer without this validation, thereby passing the unsanitized data to the external credential helper.
Both functions are critical in the vulnerable execution path: Creds.buffer for creating the malformed input, and commandCredentialHelper.exec for using that input in a sensitive operation.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/git-lfs/git-lfs/v3 | go | >= 3.0.0, <= 3.6.0 | 3.6.1 |
| github.com/git-lfs/git-lfs | go | >= 0.1.0, <= 3.0.0 |
A Semantic Attack on Google Gemini - Read the Latest Research