{"id":"MGASA-2026-0570","summary":"Updated libgit2 package fixes security vulnerabilities","details":"Inverted IP SubjectAltName Comparison in OpenSSL Backend.\n(CVE-2026-53583)\nSubmodule path traversal. (CVE-2026-53584)\nUnbounded Memory Allocation via Delta Object Result-Size Header.\n(CVE-2026-53585)\nHTTP transport can leak credentials to an offsite redirect target.\n(CVE-2026-53586)\nUnauthenticated network-reachable heap out-of-bounds read in\ntransports/smart_pkt.c:set_data. (CVE-2026-53587)\nShell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917)\n","modified":"2026-10-30T15:45:02.524280865Z","published":"2026-10-30T15:30:36Z","upstream":["CVE-2026-53583","CVE-2026-53584","CVE-2026-53585","CVE-2026-53586","CVE-2026-53587","CVE-2026-5917"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0570.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=35993"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2/"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/08/20/4"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8628-1"},{"type":"WEB","url":"https://lists.debian.org/debian-security-announce/2026/msg00364.html"}],"affected":[{"package":{"name":"libgit2","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/libgit2?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1.1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0570.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}