{"id":"openSUSE-SU-2026:22134-1","summary":"Security update for gh","details":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.102.0, fixing four security issues\n  (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,\n  GHSA-wjmr-j3rp-mh2g):\n\n  * gh release/run/attestation download and repo read-file --output\n    could write to an unintended file through symbolic links\n  * gh attestation verify compared --source-ref case-insensitively\n  * gh attestation verify matched --signer-workflow only by prefix\n  * gh skill search could inject options into gh skill install\n  * Copy auth codes to the clipboard by default (gh config set\n    clipboard disabled to opt out)\n  * Remove the gh repo garden command and the multi-account migration\n  * Use API SSH URLs for repository clones\n  * Validate repository names during interactive creation\n  * Fix remote branch deletion on owner case mismatch\n  * Propagate the gh path to extensions\n  * Allow ghu_ tokens to attach files\n  * Allow gh repo set-default --unset without an argument\n  * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,\n    github.com/klauspost/compress to 1.20.1 and Go to 1.27.1\n- Update golang.org/x/net to 0.60.0 to fix\n  excessive CPU consumption on repeated HTTP/2 initial window\n  changes (CVE-2026-78669, bsc#1285291).\n- Require golang(API) \u003e= 1.27 as upstream moved to Go 1.27.\n- Not affected, vendored dependencies are above the fixed version:\n  * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2\n  * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):\n    grpc is 1.83.2, fixed in 1.83.1\n  * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in\n    1.44.0\n  * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,\n    contains the fix of 1.18.7\n  * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed\n    version\n  * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last\n    affected version\n","modified":"2026-10-20T19:15:03.960243328Z","published":"2026-10-19T17:22:04Z","related":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"],"upstream":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271215"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276707"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276755"},{"type":"REPORT","url":"https://bugzilla.suse.com/1278962"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279208"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279310"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283727"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285291"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41178"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59831"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63209"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-72924"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78669"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84303"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84304"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84445"}],"affected":[{"package":{"name":"gh","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/gh&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"gh-zsh-completion":"2.102.0-bp160.1.1","gh":"2.102.0-bp160.1.1","gh-bash-completion":"2.102.0-bp160.1.1","gh-fish-completion":"2.102.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22134-1.json"}}],"schema_version":"1.9.0"}