MGASA-2026-0589

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0589.html
Import Source
https://advisories.mageia.org/MGASA-2026-0589.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0589
Upstream
CVE (7)
Published
2026-11-10T16:31:41Z
Modified
2026-11-10T16:58:15Z
Summary
Updated python-dulwich & rust-similar3 packages fixes security vulnerabilities
Details

Commit subjects not sanitized in porcelain.format_patch Unbounded memory allocation in receive-pack from crafted thin packs Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout. Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks. Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations. Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution. Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

References
Credits

Affected packages

Mageia:10 / python-dulwich

Package

Name
python-dulwich
Purl
pkg:rpm/mageia/python-dulwich?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.21-1.1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0589.json"

Mageia:10 / rust-similar3

Package

Name
rust-similar3
Purl
pkg:rpm/mageia/rust-similar3?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0589.json"