Detections
Analytics

openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21558-1)

high Nessus Plugin ID 335081

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21558-1 advisory.

 Changes in gitoxide:

 - Update to 0.56.0:
 * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules trust check could be bypassed in gix_submodule::File::update(), which allowed arbitrary command execution from a crafted .gitmodules file
 * Fixes a submodule name validation bypass that allowed traversal out of .git/modules and disclosure of credentials
 * Fixes symlinked .gitmodules files being followed and parsed from outside the repository
 * Fixes several denial-of-service vectors in gix-pack: unchecked indexing panics and uncapped allocations from crafted pack data
 * Fixes HTTP credentials being leaked to the redirected host by the curl transport backend
 * Add the gix config show, gix config list, gix config fmt, gix free remote refs, gix free trust, gix dirwalk and gix tix subcommands
 * Add a gix status --untracked flag and gix merge tree --message for creating commits
 * gix exclude query is now index-aware and no longer reports ignore matches for tracked files, matching git check-ignore
 * Preserve all configured remote URLs rather than only the last one
 * Fix fetching and cloning with tag refspecs in shallow clones, relative worktree linking files and loose ref path-prefix collisions
 * Update the crates to the Rust 2024 edition
 - Refresh the vendored dependencies. Recording the state of the remaining open CVE bugs against this version, none of which it is affected by:
 * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1, above the 1.11.1 fix
 * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far above the 0.17.0 that fixed the world-writable checkout of executable files

 - update to 0.50.0:
 see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0

 - update to 0.42.0:
 * add first 'debug' version of gix diff file
 * use revspecs for revision and path
 * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872

 - Update to version 0.41.0:
 * add gix blame -L start,end
 * add gix env to print paths relevant to the Git installation.
 * Document the remaining subcommands
 * Add support for statistics and additional performance information.
 * add gix blame to the CLI. That way it's possible to see the blame result of any file in the repository.

 - Updates from version 0.40.0:
 * add first 'debug' version of gix log. It's primarily meant to better understand gix blame.
 * add --tree-favor to gix merge tree|commit. With it one can decide which side to favor in case of irreconcilable tree-conflicts.
 * CVE-2025-22620: gix-worktree-state specifies 0777 permissions when checking out executable files (boo#1236139)

 - Update to version 0.39.0:
 New Features
 * add gix merge commit --debug
 * add gix merge commits
 * add gix merge tree to merge trees similarly to git merge-tree.

 - Update to version 0.38.0:
 New Features
 * support for listing worktrees with gix worktree list
 * add first 'debug' version of gix diff tree.
 * add new gix cat command.
 * add gix merge-file with similar features as git merge-file
 * gix merge-base for the CLI Bug Fixes
 * Adjust gix clean warning and help for worktree fix
 * Clarify -r/--repositories and --skip-hidden-repositories Other
 * switch from time to jiff
 * Unify style in config support info

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gitoxide package.

See Also

https://bugzilla.suse.com/1223249

https://bugzilla.suse.com/1236139

https://bugzilla.suse.com/1240872

https://bugzilla.suse.com/1266434

https://bugzilla.suse.com/1274525

https://www.suse.com/security/cve/CVE-2024-32650

https://www.suse.com/security/cve/CVE-2025-22620

https://www.suse.com/security/cve/CVE-2025-31130

https://www.suse.com/security/cve/CVE-2026-25541

https://www.suse.com/security/cve/CVE-2026-40034

Plugin Details

Severity: High

ID: 335081

File Name: openSUSE-2026-21558-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 8/13/2026

Updated: 8/13/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.16

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-25541

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 7.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-40034

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:gitoxide

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/10/2026

Vulnerability Publication Date: 4/19/2024

Reference Information

CVE: CVE-2024-32650, CVE-2025-22620, CVE-2025-31130, CVE-2026-25541, CVE-2026-40034