Source: git-lfs Version: 3.8.1-2 Severity: grave Tags: security X-Debbugs-Cc: Sylvain Beucler <[email protected]>, [email protected], Debian Security Team <[email protected]>, [email protected] Control: affects -1 + release.debian.org
Hi As reported by Sylvain in https://bugs.debian.org/1118339#24 the fix for CVE-2025-26625 in trixie released via point release was incomplete: > While working on a bookworm update, I noticed that the trixie update > introduces a regression in the 't/t-pull.sh' integration test "pull: > with missing object". > > I believe > https://github.com/git-lfs/git-lfs/commit/e735de58a72f1333a16054985b85b863fbaec138 > fixes the issue. It does for the bookworm update, even though there are > still infrequent failures there (consistent failure -> flaky failure). > > Incidentally I also noted that > https://github.com/git-lfs/git-lfs/commit/35728a6d0d488a5904cc9f03ac302680d0858583 > is related to this CVE but wasn't applied in trixie. > > https://security-tracker.debian.org/tracker/CVE-2025-26625 is updated. > > Attached is a trace. Making a separate bug from it, so ideally get fixed ain the next point release as well? Regards, Salvatore
