openSUSE-SU-2026:22204-1
openSUSE-SU-2026:22204-1 · Security update for stgit
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
This update for stgit fixes the following issues: Changes in stgit: - Update to version 2.7.0: * Allow unambiguous command shorthands, opt-in with `stgit.infer-commands`. * Accept git approxidate spellings for dates, e.g. "2 days ago" and "@<epoch>"; relative dates are now anchored in the local time zone. * Run `git mergetool` for `stg push` with `stgit.autoimerge`. * Reject "@" as a branch name for `stg branch --create`. * Bump gix to 0.89 and MSRV to 1.88. * CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742). * CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).
Есть исправление
- Опубликовано
- Обновлено
Стек: system
Затронутые продукты и версии
stgit openSUSE:Leap 16.0
- Затронутые диапазоны версий
- ECOSYSTEM: < 2.7.0-bp160.1.1
Обновитесь до 2.7.0-bp160.1.1
Первоисточники
- https://bugzilla.suse.com/1262997
- https://bugzilla.suse.com/1281742
- https://bugzilla.suse.com/1285176
- https://www.suse.com/security/cve/CVE-2026-109349
- https://www.suse.com/security/cve/CVE-2026-109350
- https://www.suse.com/security/cve/CVE-2026-109351
- https://www.suse.com/security/cve/CVE-2026-91986
- https://osv.dev/vulnerability/openSUSE-SU-2026:22204-1