CVE-2024-53263

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential(1) command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.

This vulnerability in Git LFS is important rather than moderate because it directly impacts the security of credential handling, a core aspect of repository access control. By allowing an attacker to inject line-ending control characters, such as LF or CR, into URLs passed to the git-credential command, it bypasses a fundamental trust boundary between Git and the credential helper. This issue could enable attackers to intercept or exfiltrate user credentials, granting unauthorized access to repositories, including private and sensitive data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.