openSUSE-SU-2026:22130-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22130-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22130-1
- Upstream
- Related
- Published
- 2026-10-19T16:28:23Z
- Modified
- 2026-10-20T19:15:04Z
- Summary
- Security update for grok-build
- Details
-
This update for grok-build fixes the following issues:
Changes in grok-build:
- CVE-2026-109349: gix-pack pack version 3 header assertion failure (boo#1285155)
- CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw (boo#1285155)
- CVE-2026-109351: gix-pack header object-count denial of service (boo#1285155)
- Refresh vendored Rust dependencies (gix 0.83.0 -> 0.88.0, gix-pack 0.70.0 -> 0.75.0, gix-status 0.30.0 -> 0.35.0); re-audited licences (913 external crates in the shipped graph, 1247 vendored); licence set unchanged
- adapt xai-fast-worktree to the gix 0.88 API (anyhow Context bound, from_bstr signature)
- References
Affected packages
openSUSE:Leap 16.0 / grok-build
Package
- Name
- grok-build
- Purl
- pkg:rpm/opensuse/grok-build&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.0.45+git20260929.2bdd1d6-bp160.2.1
Ecosystem specific
{
"binaries": [
{
"grok-build": "1.0.45+git20260929.2bdd1d6-bp160.2.1",
"grok-build-bash-completion": "1.0.45+git20260929.2bdd1d6-bp160.2.1",
"grok-build-fish-completion": "1.0.45+git20260929.2bdd1d6-bp160.2.1",
"grok-build-zsh-completion": "1.0.45+git20260929.2bdd1d6-bp160.2.1"
}
]
}