{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21861-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for gh\n\nThis update for gh fixes the following issues:\n\nChanges in gh:\n\nUpdate to version 2.100.0, fixing two deadlock issues in the vendored\ngolang.org/x/crypto/ssh library reachable via crafted SSH channel\nmessages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):\n\n* Fix gh api telemetry disablement\n* Bump go-gh to v2.16.0\n* Expose per-host API host config\n* chore: bump toolchain to go1.26.8\n* chore: bump golang.org/x/crypto to 0.56.0\n* Record attachment invocation telemetry\n* Add webhook as an official extension\n* Merge pull request #14318 from cli/issue-triage-improvements\n* Refine GHES support wording\n* Use version-neutral GHES support link\n* Clarify supported GHES versions\n* Bump go-gh to v2.15.0\n* Remove redundant searcher comment\n* Remove unnecessary 204 on release edit\n* Remove redundant comment in gist create\n* Comment api command api_host usage\n* Comment missing api-client-rollout todo\n* Document when telemetry disabling is overzealous\n* Refactor AddAuthTokenHeader\n* Rename tokenGetter to config\n* build(deps): bump go-gh to rebased per-host api_host branch\n* refactor(attachments): send uploads through api.Client.DoRequest\n* test(internal/attachments): add new method required by interface\n* fix(api): compare request hostname without port when attaching auth token\n* test(acceptance): fix scriptfilter table field alignment\n* build(deps): bump go-gh to per-host api_host branch\n* chore(codeql): cover api.Client.Request in SafeURL path query\n* fix(auth/shared): route GetScopes path through safeurl\n* test(config): add coverage for APIHostForHost\n* test(config): cover deterministic api_host collision resolution\n* test(api): assert DoRequest preserves an explicit ContentLength\n* test(acceptance): cover selecting multiple scripts in one directory\n* refactor(api): use errors.AsType for HTTP error checks\n* fix(config): resolve api_host collisions deterministically\n* docs(api): clarify redirect method-rewriting in comments\n* Send release asset uploads and downloads through api.Client\n* Let callers set headers on a shared client request\n* Let a caller stop a request following redirects\n* Let a caller name the scopes an endpoint needs\n* Add a raw response request surface to api.Client\n* Send RenameRepo to a relative path\n* Make gh api honour api_host for relative paths\n* Send a host's token to its configured api_host\n* Add the api_host gateway harness\n* Let GH_ACCEPTANCE_SCRIPT name several scripts\n* Wait longer for the search index in the issues script\n* Add acceptance coverage for gist\n* Fix discussion acceptance test flags\n* Resolve aliases to their target when rendering full help on error\n* Print full help on command misuse for invoking agents\n\nUpdate to version 2.99.0:\n\n* Add repeatable --attach flag to upload local images/videos to\n  issues, pull requests, and comments (max 50 files per call)\n* Add worktree checkout support to gh issue develop --checkout\n  --worktree\n* Fix repo sync to avoid corrupting a linked worktree and to\n  explain when the target branch is checked out elsewhere\n* Fix pr merge --delete-branch to safely handle linked worktrees\n* Reject --comments combined with --json on view commands","dates":{"published":"2026-09-15T16:45:32.000Z","modified":"2026-09-17T18:23:14.640Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"gh&distro=openSUSE Leap 16.0","name":"gh","label":"gh&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/gh&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 2.100.0-bp160.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.100.0-bp160.1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1278604","label":"bugzilla.suse.com/1278604","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","label":"www.suse.com/security/cve/CVE-2026-56854","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","label":"www.suse.com/security/cve/CVE-2026-56855","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","label":"www.suse.com/security/cve/CVE-2026-78662","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"],"downstream":[],"duplicates":[],"related":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662"]},"timeline":[{"kind":"published","date":"2026-09-15T16:45:32.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-17T18:23:14.640Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T18:54:13.950Z","stale":false,"partial":false}}