[Git][security-tracker-team/security-tracker][master] CVE-2025-26625/git-lfs: fix patches order, add additional patches, update git version

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
16e1ee20 by Sylvain Beucler at 2026-10-08T18:30:39+02:00
CVE-2025-26625/git-lfs: fix patches order, add additional patches, update git version

The first patch 35728a6d is indirectly referenced by the current one 5c11ffce
("In a previous commit we partially addressed this vulnerability by...")
and also comes before in the Git history

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -246527,9 +246527,12 @@ CVE-2025-26625 (Git LFS is a Git extension for versioning large files. In Git LF
 	[trixie] - git-lfs 3.6.1-1+deb13u1
 	[bookworm] - git-lfs <no-dsa> (Minor issue)
 	NOTE: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5
-	NOTE: https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396 (main)
-	NOTE: https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8 (main)
-	NOTE: https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615 (main)
+	NOTE: Fixed by: https://github.com/git-lfs/git-lfs/commit/35728a6d0d488a5904cc9f03ac302680d0858583 (v3.8.0)
+	NOTE: Fixed by: https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8 (v3.8.0)
+	NOTE: Fixed by: https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396 (v3.8.0)
+	NOTE: Hardening: https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615 (v3.8.0)
+	NOTE: Additional tests: https://github.com/git-lfs/git-lfs/commit/fae470a838977d97c44e4478a9db2769ed108b9d (v3.8.0)
+	NOTE: Additional tests: https://github.com/git-lfs/git-lfs/commit/cc92eff2519d105e490c1c9349e862f392d11877 (v3.8.0)
 CVE-2025-11925 (Incorrect Content-Type header in one of the APIs (`text/html` instead  ...)
 	NOT-FOR-US: BLU-IC2 and BLU-IC4
 CVE-2025-11911 (A vulnerability was detected in Shenzhen Ruiming Technology Streamax C ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/16e1ee20a3ee799b912ab900b0e71ac27e09011f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/16e1ee20a3ee799b912ab900b0e71ac27e09011f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/e677d1d3/attachment-0001.htm>