453 matches found
CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...
CVE-2026-92615
flightctl 's configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify , a custom CA bundle, or tenant-supplied mTLS client certificates ) and installs it into go-git's process-global client.Protocols map via gitclient...
SUSE-SU-2026:4210-1 Security update for alloy
This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names
A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues: CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...
SUSE-SU-2026:4082-1 Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues: - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed...
Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
SUSE-SU-2026:3916-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
CVE-2026-45570
A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell SSH communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a...
CVE-2026-45022
A flaw was found in go-git, an extensible Git implementation library. This vulnerability arises from go-git's differing interpretation of malformed Git objects compared to upstream Git. When processing commit or tag objects with ambiguous or malformed headers, go-git may sign or verify a commit...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
Security Bulletin: Security Vulnerabilities have been found in IBM Sovereign Core
Summary Security Vulnerabilities have been addressed in IBM Sovereign Core Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
SUSE CVE-2026-71556
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...
SUSE CVE-2026-71557
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...
Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL
Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.3. Vulnerability Details CVEID:CVE-2026-71557 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized befor...