openSUSE Security Update: Security update for git-lfs
______________________________________________________________________________
Announcement ID: openSUSE-SU-2026:0305-1
Rating: important
References: #1239322 #1252259
Cross-References: CVE-2025-22869 CVE-2025-26625
CVSS scores:
CVE-2025-22869 (SUSE): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVE-2025-26625 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Backports SLE-15-SP7
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for git-lfs fixes the following issues:
- update to 3.7.1: (boo#1252259 CVE-2025-26625)
This release introduces security fixes for Linux, macOS, and Windows
systems, which have been collectively assigned CVE-2025-26625.
When populating a Git repository's working tree with the contents
of Git LFS objects, certain Git LFS commands may write to files visible
outside the current Git working tree if symbolic or hard links exist
which collide with the paths of files tracked by Git LFS.
Git LFS has resolved this problem by revising the git lfs checkout and
git lfs pull commands so that they check for symbolic links in the same
manner as performed by Git before writing to files in the working tree.
These commands now also remove existing files in the working tree before
writing new files in their place.
As well, Git LFS has resolved a problem whereby the git lfs checkout and
git lfs pull commands, when run in a bare repository, could write to files
visible outside the repository. While a specific and relatively unlikely
set of conditions were required for this to occur, it is no longer
possible under any circumstances.
We would like to extend a special thanks to the following
open-source contributors: Apple Product Security for reporting this to
us responsibly
* Bugs
- Detect symbolic links on checkout and pull (@chrisd8088)
* Misc
- Upgrade to Go 1.25 (@chrisd8088)
- update to 3.7.0
This release is a feature release which introduces several new options
for fetching Git LFS objects, such as the ability to force objects to be
re-downloaded and the capacity to output object URLs and HTTP metadata in
JSON for external tools to consume. This release also adds a configurable
in-memory cache of file path pattern matches, which along with other
changes can help reduce the time required to migrate large repositories to
Git LFS.
Git LFS now supports the same .netrc files on Windows as Git and curl,
retries appropriately after all 429 status code HTTP responses, permits
the use of symbolic links to Git's object storage during Git LFS migrations
- Features
- Cache a file path filter match result #6047 (@alexkad0)
- Add --refetch option to fetch #5975 (@redsun82)
- Add --json option to fetch #5974 (@redsun82)
- Add --dry-run option to fetch #5973 (@redsun82)
- Bugs
- Verify TLS/SSL certificates using default Go support for macOS
system root CAs #6049 (@chrisd8088)
- Prefer .netrc on windows if present #6055 (@johanvdw)
- Fix migrations where .git/objects is a symlink #6042 (@bk2204)
- Honour 429 object transfer response Retry-After headers #6014
(@chrisd8088)
- Misc
- Update Linux distribution package list for v3.7.0 release
(@chrisd8088)
- Report missing objects consistently when pushing #6027 (@chrisd8088)
- Use a git-update-ref script to update references #6048 (@alexkad0)
- Drop unused generic stub function for cloning files #6050
(@chrisd8088)
- Prevent conflicting curl macros in early Git version CI jobs #6040
(@chrisd8088)
- pull: improve error message on failing checkout #5629 (@bk2204)
- Fix language in code snippets in API docs #6035 (@slonopotamus)
- build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 #6034
(@dependabot[bot])
- Use single-target Makefile patterns for manual pages #6032
(@chrisd8088)
- use direct value nil for error #6024 (@alingse)
- Update minimum required Git version checks #6028 (@chrisd8088)
- build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 #6012
(@dependabot[bot])
- Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 bsc#1239322
#5997 (@gergelyfabian)
- Upgrade to Go 1.24 #6013 (@chrisd8088)
- Use constant format strings and fix HTTP error messages #5998
(@chrisd8088)
- Remove command name prefixes from progress messages #5995
(@chrisd8088)
- doc: Add missing "--to" argument in git-lfs-checkout example #6005
(@DarkDefender)
- Replace min/max helpers with built-in min/max #5999 (@Juneezee)
- Add security patch release process documentation #5987 (@chrisd8088)
- Replace unused debug mode with trace logging #5989 (@chrisd8088)
- Use default Ruby provided by Actions runners #5984 (@chrisd8088)
- build(deps): bump azure/trusted-signing-action from 0.5.0 to 0.5.1
#5981 (@dependabot[bot])
- Update workflows to use ARM runners and new Apple signing
certificate #5977 (@chrisd8088)
- docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable
description #5959 (@m3ka24)
- docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944 (@fedirz)
- Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940 (@gergelyfabian)
- build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0 #5935
(@dependabot[bot])
- Simplify macOS CI jobs and specify Go toolchain version #5931
(@chrisd8088)
- Tighten security of Actions workflows #5930 (@bk2204)
- Corrected Pop!_OS naming #5929 (@LucasDondo)
- Update release process documentation and scripts #5920 (@chrisd8088)
- Update license copyright dates and minimum supported Git version
#5921 (@chrisd8088)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-305=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):
git-lfs-3.7.1-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-22869.html
https://www.suse.com/security/cve/CVE-2025-26625.html
https://bugzilla.suse.com/1239322
https://bugzilla.suse.com/1252259
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.