openSUSE-SU-2026:22134-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22134-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22134-1
Upstream
CVE (8)
Related
CVE (8)
Published
2026-10-19T17:22:04Z
Modified
2026-10-20T19:15:03Z
Summary
Security update for gh
Details

This update for gh fixes the following issues:

Changes in gh:

  • Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g):

    • gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links
    • gh attestation verify compared --source-ref case-insensitively
    • gh attestation verify matched --signer-workflow only by prefix
    • gh skill search could inject options into gh skill install
    • Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out)
    • Remove the gh repo garden command and the multi-account migration
    • Use API SSH URLs for repository clones
    • Validate repository names during interactive creation
    • Fix remote branch deletion on owner case mismatch
    • Propagate the gh path to extensions
    • Allow ghu_ tokens to attach files
    • Allow gh repo set-default --unset without an argument
    • Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0, github.com/klauspost/compress to 1.20.1 and Go to 1.27.1

  • Update golang.org/x/net to 0.60.0 to fix excessive CPU consumption on repeated HTTP/2 initial window changes (CVE-2026-78669, bsc#1285291).

  • Require golang(API) >= 1.27 as upstream moved to Go 1.27.

  • Not affected, vendored dependencies are above the fixed version:

    • CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
    • CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310): grpc is 1.83.2, fixed in 1.83.1
    • CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in 1.44.0
    • CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1, contains the fix of 1.18.7
    • CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed version
    • CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last affected version
References

Affected packages

openSUSE:Leap 16.0 / gh

Package

Name
gh
Purl
pkg:rpm/opensuse/gh&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.102.0-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "gh":  "2.102.0-bp160.1.1",
            "gh-bash-completion":  "2.102.0-bp160.1.1",
            "gh-fish-completion":  "2.102.0-bp160.1.1",
            "gh-zsh-completion":  "2.102.0-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22134-1.json"