Описание
Security update for git-bug
This update for git-bug fixes the following issues:
Changes in git-bug:
- CVE-2026-1229: CIRCL had an incorrect calculation in secp384r1 CombinedMult (bsc#1265416, GO-2026-4550): updated github.com/cloudflare/circl to v1.6.3
- CVE-2026-41506: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264955, GO-2026-4910): updated github.com/go-git/go-git/v5 to v5.17.1
Список пакетов
openSUSE Leap 16.0
git-bug-0.10.1-bp160.2.1
git-bug-bash-completion-0.10.1-bp160.2.1
git-bug-fish-completion-0.10.1-bp160.2.1
git-bug-zsh-completion-0.10.1-bp160.2.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1264955
- SUSE Bug 1265416
- SUSE CVE CVE-2026-1229 page
- SUSE CVE CVE-2026-41506 page
Описание
The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .
Затронутые продукты
openSUSE Leap 16.0:git-bug-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-bash-completion-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-fish-completion-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-zsh-completion-0.10.1-bp160.2.1
Ссылки
- CVE-2026-1229
- SUSE Bug 1265416
Описание
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
Затронутые продукты
openSUSE Leap 16.0:git-bug-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-bash-completion-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-fish-completion-0.10.1-bp160.2.1
openSUSE Leap 16.0:git-bug-zsh-completion-0.10.1-bp160.2.1
Ссылки
- CVE-2026-41506
- SUSE Bug 1264854