{"id":"openSUSE-SU-2026:22204-1","summary":"Security update for stgit","details":"This update for stgit fixes the following issues:\n\nChanges in stgit:\n\n- Update to version 2.7.0:\n  * Allow unambiguous command shorthands, opt-in with\n    `stgit.infer-commands`.\n  * Accept git approxidate spellings for dates, e.g. \"2 days ago\"\n    and \"@\u003cepoch\u003e\"; relative dates are now anchored in the local\n    time zone.\n  * Run `git mergetool` for `stg push` with `stgit.autoimerge`.\n  * Reject \"@\" as a branch name for `stg branch --create`.\n  * Bump gix to 0.89 and MSRV to 1.88.\n  * CVE-2026-91986: gix-transport CR/LF/NUL injection into\n    git-daemon connect request via crafted git URL path\n    (boo#1281742).\n  * CVE-2026-109349, CVE-2026-109350, CVE-2026-109351:\n    gix-pack denial of service via pack version 3 header,\n    ofs-delta base distance and pack header object count\n    (boo#1285176).\n","modified":"2026-10-31T18:00:09.599232859Z","published":"2026-10-29T19:17:38Z","related":["CVE-2026-109349","CVE-2026-109350","CVE-2026-109351","CVE-2026-91986"],"upstream":["CVE-2026-109349","CVE-2026-109350","CVE-2026-109351","CVE-2026-91986"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262997"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281742"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285176"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109349"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109350"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109351"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-91986"}],"affected":[{"package":{"name":"stgit","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/stgit&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"stgit-bash-completion":"2.7.0-bp160.1.1","stgit-emacs":"2.7.0-bp160.1.1","stgit-fish-completion":"2.7.0-bp160.1.1","stgit-vim-plugin":"2.7.0-bp160.1.1","stgit-zsh-completion":"2.7.0-bp160.1.1","stgit":"2.7.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22204-1.json"}}],"schema_version":"1.9.2"}