openSUSE-SU-2026:22204-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22204-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22204-1

Upstream

CVE (4)

Related

CVE (4)

Published

2026-10-29T19:17:38Z

Modified

2026-10-31T18:00:09Z

Summary

Security update for stgit

Details

This update for stgit fixes the following issues:

Changes in stgit:

Update to version 2.7.0:
- Allow unambiguous command shorthands, opt-in with stgit.infer-commands.
- Accept git approxidate spellings for dates, e.g. "2 days ago" and "@"; relative dates are now anchored in the local time zone.
- Run git mergetool for stg push with stgit.autoimerge.
- Reject "@" as a branch name for stg branch --create.
- Bump gix to 0.89 and MSRV to 1.88.
- CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742).
- CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).

References

Affected packages

openSUSE:Leap 16.0 / stgit

Package

Name: stgit
Purl: pkg:rpm/opensuse/stgit&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.0-bp160.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "stgit":  "2.7.0-bp160.1.1",
            "stgit-bash-completion":  "2.7.0-bp160.1.1",
            "stgit-emacs":  "2.7.0-bp160.1.1",
            "stgit-fish-completion":  "2.7.0-bp160.1.1",
            "stgit-vim-plugin":  "2.7.0-bp160.1.1",
            "stgit-zsh-completion":  "2.7.0-bp160.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22204-1.json"