Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f781ece2 by Salvatore Bonaccorso at 2026-08-07T22:23:57+02:00
Add two go-git issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -26,9 +26,19 @@ CVE-2026-71559 (Deserialization of Untrusted Data
vulnerability in the Go implem
CVE-2026-71558 (Heap type confusion vulnerability in Apache Fory C++
deserialization. ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71557 (go-git is an extensible git implementation library written in
pure Go. ...)
- TODO: check
+ - golang-github-go-git-go-git-v6 <unfixed>
+ - golang-github-go-git-go-git <unfixed>
+ NOTE:
https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
+ NOTE: https://github.com/go-git/go-git/pull/2247
+ NOTE: Fixed by (merge):
https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36
(v6.0.0-alpha.5)
+ NOTE: https://github.com/go-git/go-git/pull/2254
+ NOTE: Fixed by (merge):
https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7
(v5.19.2)
CVE-2026-71556 (go-git is an extensible git implementation library written in
pure Go. ...)
- TODO: check
+ - golang-github-go-git-go-git-v6 <unfixed>
+ - golang-github-go-git-go-git <unfixed>
+ NOTE:
https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm
+ NOTE: Fixed by:
https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
(v6.0.0-alpha.5)
+ NOTE: Fixed by:
https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
(v5.19.2)
CVE-2026-70561 (TestLink 1.9.20 and prior contains an insecure direct object
reference ...)
TODO: check
CVE-2026-69127 (Kirby is an open-source content management system. Prior to
4.9.5 and ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f781ece281daeb7cffb74795073f11481a19ef82
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f781ece281daeb7cffb74795073f11481a19ef82
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
