openSUSE 16 Security Update : forgejo-cli (openSUSE-SU-2026:21605-1)

medium Nessus Plugin ID 338630

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21605-1 advisory.

Changes in forgejo-cli:

- Update vendored bytes crate to 1.12.1
* CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

- update to 0.6.0:
* Localization!
- forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself.
Currently de-DE and zh-Hans are included, with several more being in-progress.
See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
* Additions
- (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request
- (!582) --avatar/--unset-avatar options on fj repo edit
- (!554) fj repo star-status to check if you've starred a repo
- (!547) --cwd option to set the working directory a command is run in
- (!533, !561) Commands to watch and unwatch repos
- (!462) Resolve SSH host names from SSH config
- (!279, !464, !472, !489, !491, !513, !594) Localization
- Added fj auth login support for the following instances:
- v16.next.forgejo.org
- v17.next.forgejo.org
- Removed fj auth login support for the following instances that have shut down:
- v7.next.forgejo.org
- v12.next.forgejo.org
* Changes
- (!535) Added an error message when fj auth login fails to open the browser
- (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change.
- (!514) The --host flag can now be anywhere in the command, instead of only the beginning
- (!504) fj auth add-token no longer takes a username argument.
* Fixes
- (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users
- (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash
- (!542) Fixed parsing of SSH shorthand urls
- (!510) Fixed fj pr checkout failing when the instance URL contained a port
- (!437) Fixed incorrect parsing of activity info
* Other
- (!573) Use rust 2024 edition
- (!560) Simplify determining repo owner
- (!531) Fix clippy warnings
- (!527) Remove unused dependencies, narrow tokio features
- (!526) Replace crossterm with terminal_size
- (!520) Optimize cargo release profile
- (!469) Fix typo
- (!449) Restricted file permissions at creation time
- (!443) Add oneline helptext to 'repo migrate' command

- update to 0.5.0:
* Additions
- (!334) Support for managing labels on issues and repos.
- (!349) repo edit and repo units for modifying settings on a repo and repo units.
- (!373) Use the needed CLI flags for more editors when opening them.
- (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set).
- (!414) Add commands to assign and unassign users to issues and PRs.
- (!415) Support all README files in fj repo readme, regardless of case or extension.
- (!416) Add the option to choose what repo to own the new repo to fj repo migrate.
- (!419) Show a warning when viewing an archived repo.
- (!420) Add a notice about git push --force not being supported on AGit PRs.
- Added fj auth login support for the following instances:
- v15.next.forgejo.org
- codefloe.com
* Fixes
- (!393) Don't include pull requests in fj issues search.
- (!407) Guarantee opening the browser in fj auth login doesn't block.
- (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens.
* Other
- (!278) Improved no repo info error message.
- (!403) Build aarch64 artifacts for new releases.

- update to 0.4.1:
* Fixes
- (!368) Generate the correct PKCE challenge verifier. This was preventing fj auth login from succeeding.

- Update to version 0.4.0:
* Support for issue & pull request templates with fj issue/pr create
--template
* fj pr create --autofill, which will automatically populate the PR's title and body from the commit(s)
* fj user key and fj user gpg commands for managing uploaded SSH and GPG keys
* fj user repos --page, to select the page of results to view
* fj issue/pr create/comment --body-from-file to use the contents of a file as the body
* --identity-file/-I flag for selecting the SSH identity to use
* fj tag to manage git tags
* fj issue search --state all
* --remote & --repo flags can now be at the end of the command with the rest of the flags

- update to 0.3.0:
* Additions
- Added fj completion to generate completion scripts for various shells
- Added fj org for Organization commands.
- Added fj actions for Forgejo Actions-related commands (thank you, @LordMZTE !)
- OAuth client IDs for fj auth login can now be customized.
See the wiki for more on the new features.
https://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations
* Fixes
- Keys file now has proper file permissions
- Fixed incorrect help commands (thank you, @0ko !)
- Always set user agent in requests

- update to 0.2.0:
* Additions
- pr create and issue create now have a --web flag that opens the creation page in your browser instead of creating it on the terminal.
- pr --agit will create a pull request with agit flow, so you don't need to fork the repository.
- pr status --wait will only exits once all PR checks finish.
- repo migrate to migrate/mirror repositories from other hosts.
- repo readme to print a repository's readme to the terminal.
- version --verbose prints extra info useful for debugging
* Fixes
- Public endpoints can now be accessed without authenticating
- The API will be accessed via the http url even when it differs from the ssh url and the local remote points to the ssh url.
- browse commands will no long hang the terminal
- Local repos will now be found even when in a subdirectory
- SSH urls in repo remotes will now be parsed correctly
- Improved pull request detection

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected forgejo-cli package.

Plugin Details

Severity: Medium

ID: 338630

File Name: openSUSE-2026-21605-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/21/2026

Updated: 8/21/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.75

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-25541

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:forgejo-cli

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 4/8/2025

Reference Information

CVE: CVE-2025-3416, CVE-2025-55159, CVE-2026-25541

Detections

Analytics