Описание
Security update for gh
This update for gh fixes the following issues:
Changes in gh:
-
Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g):
- gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links
- gh attestation verify compared --source-ref case-insensitively
- gh attestation verify matched --signer-workflow only by prefix
- gh skill search could inject options into gh skill install
- Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out)
- Remove the gh repo garden command and the multi-account migration
- Use API SSH URLs for repository clones
- Validate repository names during interactive creation
- Fix remote branch deletion on owner case mismatch
- Propagate the gh path to extensions
- Allow ghu_ tokens to attach files
- Allow gh repo set-default --unset without an argument
- Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0, github.com/klauspost/compress to 1.20.1 and Go to 1.27.1
-
Update golang.org/x/net to 0.60.0 to fix excessive CPU consumption on repeated HTTP/2 initial window changes (CVE-2026-78669, bsc#1285291).
-
Require golang(API) >= 1.27 as upstream moved to Go 1.27.
-
Not affected, vendored dependencies are above the fixed version:
- CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
- CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310): grpc is 1.83.2, fixed in 1.83.1
- CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in 1.44.0
- CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1, contains the fix of 1.18.7
- CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed version
- CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last affected version
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1271215
- SUSE Bug 1276707
- SUSE Bug 1276755
- SUSE Bug 1278962
- SUSE Bug 1279208
- SUSE Bug 1279310
- SUSE Bug 1283727
- SUSE Bug 1285291
- SUSE CVE CVE-2026-41178 page
- SUSE CVE CVE-2026-59831 page
- SUSE CVE CVE-2026-63209 page
- SUSE CVE CVE-2026-72924 page
- SUSE CVE CVE-2026-78669 page
- SUSE CVE CVE-2026-84303 page
- SUSE CVE CVE-2026-84304 page
- SUSE CVE CVE-2026-84445 page
Описание
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-41178
- SUSE Bug 1276509
Описание
GitHub CLI (gh) is GitHub's official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.
Затронутые продукты
Ссылки
- CVE-2026-59831
- SUSE Bug 1271215
Описание
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
Затронутые продукты
Ссылки
- CVE-2026-63209
- SUSE Bug 1283531
Описание
GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user's local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim's machine while forwarding is active. This issue is fixed in version 2.98.0.
Затронутые продукты
Ссылки
- CVE-2026-72924
- SUSE Bug 1276755
Описание
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Затронутые продукты
Ссылки
- CVE-2026-78669
- SUSE Bug 1284772
Описание
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Затронутые продукты
Ссылки
- CVE-2026-84303
- SUSE Bug 1278268
- SUSE Bug 1280553
Описание
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Затронутые продукты
Ссылки
- CVE-2026-84304
- SUSE Bug 1278271
- SUSE Bug 1280553
Описание
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Затронутые продукты
Ссылки
- CVE-2026-84445
- SUSE Bug 1278687
- SUSE Bug 1280553
- SUSE Bug 1280617