OPENSUSE-SU-2026:21861-1: gh&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:21861-1 is a vulnerability in gh&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for gh This update for gh fixes the following issues: Changes in gh: Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604): * Fix gh api telemetry disablement * Bump go-gh to v2.16.0 * Expose per-host API host config * chore: bump toolchain to go1.26.8 * chore: bump golang.org/x/crypto to 0.56.0 * Record attachment invocation telemetry * Add webhook as an official extension * Merge pull request #14318 from cli/issue-triage-improvements * Refine GHES support wording * Use version-neutral GHES support link * Clarify supported GHES versions * Bump go-gh to v2.15.0 * Remove redundant searcher comment * Remove unnecessary 204 on release edit * Remove redundant comment in gist create * Comment api command api_host usage * Comment missing api-client-rollout todo * Document when telemetry disabling is overzealous * Refactor AddAuthTokenHeader * Rename tokenGetter to config * build(deps): bump go-gh to rebased per-host api_host branch * refactor(attachments): send uploads through api.Client.DoRequest * test(internal/attachments): add new method required by interface * fix(api): compare request hostname without port when attaching auth token * test(acceptance): fix scriptfilter table field alignment * build(deps): bump go-gh to per-host api_host branch * chore(codeql): cover api.Client.Request in SafeURL path query * fix(auth/shared): route GetScopes path through safeurl * test(config): add coverage for APIHostForHost * test(config): cover deterministic api_host collision resolution * test(api): assert DoRequest preserves an explicit ContentLength * test(acceptance): cover selecting multiple scripts in one directory * refactor(api): use errors.AsType for HTTP error checks * fix(config): resolve api_host collisions deterministically * docs(api): clarify redirect method-rewriting in comments * Send release asset uploads and downloads through api.Client * Let callers set headers on a shared client request * Let a caller stop a request following redirects * Let a caller name the scopes an endpoint needs * Add a raw response request surface to api.Client * Send RenameRepo to a relative path * Make gh api honour api_host for relative paths * Send a host's token to its configured api_host * Add the api_host gateway harness * Let GH_ACCEPTANCE_SCRIPT name several scripts * Wait longer for the search index in the issues script * Add acceptance coverage for gist * Fix discussion acceptance test flags * Resolve aliases to their target when rendering full help on error * Print full help on command misuse for invoking agents Update to version 2.99.0: * Add repeatable --attach flag to upload local images/videos to issues, pull requests, and comments (max 50 files per call) * Add worktree checkout support to gh issue develop --checkout --worktree * Fix repo sync to avoid corrupting a linked worktree and to explain when the target branch is checked out elsewhere * Fix pr merge --delete-branch to safely handle linked worktrees * Reject --comments combined with --json on view commands

No weakness data has been published for this record.