openSUSE 16 Security Update : git-lfs (openSUSE-SU-2026:21621-1)

high Nessus Plugin ID 339037

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21621-1 advisory.

Changes in git-lfs:

- update to 3.7.1: (boo#1252259 CVE-2025-26625)

This release introduces security fixes for Linux, macOS, and Windows systems, which have been collectively assigned CVE-2025-26625.

When populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS.

Git LFS has resolved this problem by revising the git lfs checkout and git lfs pull commands so that they check for symbolic links in the same manner as performed by Git before writing to files in the working tree. These commands now also remove existing files in the working tree before writing new files in their place.

As well, Git LFS has resolved a problem whereby the git lfs checkout and git lfs pull commands, when run in a bare repository, could write to files visible outside the repository.
While a specific and relatively unlikely set of conditions were required for this to occur, it is no longer possible under any circumstances.

We would like to extend a special thanks to the following open-source contributors:
Apple Product Security for reporting this to us responsibly

* Bugs
- Detect symbolic links on checkout and pull (@chrisd8088)
* Misc
- Upgrade to Go 1.25 (@chrisd8088)

- update to 3.7.0

This release is a feature release which introduces several new options for fetching Git LFS objects, such as the ability to force objects to be re-downloaded and the capacity to output object URLs and HTTP metadata in JSON for external tools to consume. This release also adds a configurable in-memory cache of file path pattern matches, which along with other changes can help reduce the time required to migrate large repositories to Git LFS.

Git LFS now supports the same .netrc files on Windows as Git and curl, retries appropriately after all 429 status code HTTP responses, permits the use of symbolic links to Git's object storage during Git LFS migrations

- Features
- Cache a file path filter match result #6047 (@alexkad0)
- Add --refetch option to fetch #5975 (@redsun82)
- Add --json option to fetch #5974 (@redsun82)
- Add --dry-run option to fetch #5973 (@redsun82)
- Bugs
- Verify TLS/SSL certificates using default Go support for macOS system root CAs #6049 (@chrisd8088)
- Prefer .netrc on windows if present #6055 (@johanvdw)
- Fix migrations where .git/objects is a symlink #6042 (@bk2204)
- Honour 429 object transfer response Retry-After headers #6014 (@chrisd8088)
- Misc
- Update Linux distribution package list for v3.7.0 release (@chrisd8088)
- Report missing objects consistently when pushing #6027 (@chrisd8088)
- Use a git-update-ref script to update references #6048 (@alexkad0)
- Drop unused generic stub function for cloning files #6050 (@chrisd8088)
- Prevent conflicting curl macros in early Git version CI jobs #6040 (@chrisd8088)
- pull: improve error message on failing checkout #5629 (@bk2204)
- Fix language in code snippets in API docs #6035 (@slonopotamus)
- build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 #6034 (@dependabot[bot])
- Use single-target Makefile patterns for manual pages #6032 (@chrisd8088)
- use direct value nil for error #6024 (@alingse)
- Update minimum required Git version checks #6028 (@chrisd8088)
- build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 #6012 (@dependabot[bot])
- Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 bsc#1239322 #5997 (@gergelyfabian)
- Upgrade to Go 1.24 #6013 (@chrisd8088)
- Use constant format strings and fix HTTP error messages #5998 (@chrisd8088)
- Remove command name prefixes from progress messages #5995 (@chrisd8088)
- doc: Add missing --to argument in git-lfs-checkout example #6005 (@DarkDefender)
- Replace min/max helpers with built-in min/max #5999 (@Juneezee)
- Add security patch release process documentation #5987 (@chrisd8088)
- Replace unused debug mode with trace logging #5989 (@chrisd8088)
- Use default Ruby provided by Actions runners #5984 (@chrisd8088)
- build(deps): bump azure/trusted-signing-action from 0.5.0 to 0.5.1 #5981 (@dependabot[bot])
- Update workflows to use ARM runners and new Apple signing certificate #5977 (@chrisd8088)
- docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable description #5959 (@m3ka24)
- docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944 (@fedirz)
- Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940 (@gergelyfabian)
- build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0 #5935 (@dependabot[bot])
- Simplify macOS CI jobs and specify Go toolchain version #5931 (@chrisd8088)
- Tighten security of Actions workflows #5930 (@bk2204)
- Corrected Pop!_OS naming #5929 (@LucasDondo)
- Update release process documentation and scripts #5920 (@chrisd8088)
- Update license copyright dates and minimum supported Git version #5921 (@chrisd8088)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected git-lfs package.

Plugin Details

Severity: High

ID: 339037

File Name: openSUSE-2026-21621-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/23/2026

Updated: 8/23/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-26625

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2025-22869

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 6.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:git-lfs

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/21/2026

Vulnerability Publication Date: 2/26/2025

Reference Information

CVE: CVE-2025-22869, CVE-2025-26625

Detections

Analytics