Detections
Analytics
openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:22126-1)
medium Nessus Plugin ID 370426
Synopsis
The remote openSUSE host is missing a security update.Description
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22126-1 advisory.Changes in gitoxide:
Update to version 0.60.0:
* BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the prodash-render-tui feature are gone, line progress stays the only progress UI
* Trace output is now independently configurable with a bounded
-t/--trace counter, separate from verbose and progress rendering
* Add gix worktree add (alias create) and worktree remove
* Various security improvements and more consistent error handling across the plumbing crates
- Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged.
- Restore the explicit prodash feature dropped in the gix-utils 0.5.0 dep:
migration, which broke workspace-wide cargo metadata --features as run by cargo-auditable.
Update to version 0.59.0:
* Ships gix-transport 0.60.0, which rejects NUL/LF in git-daemon connect requests: drops the backported fix for CVE-2026-91986 (boo#1281749), now fixed upstream
* gix-transport-reject-control-bytes.patch
* New gix editor command with Git-compatible selection
* Raise the Rust floor to 1.88 (upstream MSRV, dua-core)
- Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged.
Update to 0.58.0:
* gix tix is now the full gix-tix platform embedded in the plumbing command instead of a second parser and dispatcher, so standalone and plumbing invocations behave alike and amend and spill are reachable through gix tix
* tix decorates commits checked out by other main or linked worktrees with light-blue name@ labels, keeps the marker for the checkout it was opened from, and watches linked HEAD and worktree membership so the decorations stay current
* tix gained -w/--worktrees to add every resolved worktree HEAD to the traversal tips without weakening hidden-revision exclusions
* gix tix no longer accepts --screen: the interactive history always owns the alternate screen, so the automatic and half-screen modes were removed
- Refresh the vendored dependencies. The linked graph gains a second MPL-2.0 crate, option-ext, reached through the directories and dirs-sys crates that gix-tix newly depends on; the License tag already covers MPL-2.0 and is unchanged.
Update to 0.57.0:
* Add gix clone --revision, and PrepareFetch::with_revision(), for cloning a single revision named by a full ref, HEAD or a full object id: HEAD is detached to the fetched commit, no ordinary refs are created, no fetch refspec is persisted and tag following is disabled
* Fix a panic when a full object id was passed to with_ref_name(), which produced an object-id refspec mapping that clone expected to be named
* Rewrite relative date parsing to follow git: several count and unit pairs are applied in input order, as in 2 days 3 hours ago, counts may be spelled out, any non-alphanumeric byte separates the parts, the trailing ago is optional, and a leading @ may introduce a timestamp. Month and year steps now walk the calendar fields, so a day past the end of the shorter target month rolls over into the following month
* gix commit verify now checks signatures through the library rather than spawning gpg itself, so the configured gpg program is honoured and an invalid or untrusted signature is reported as such
* Fix the conflict stage labels printed by gix revision explain, which called stage 0 base; they are now unconflicted, base, ours and theirs
* Reject a TREE index extension whose child entry counts overflow instead of wrapping while verifying them
* Replace the jwalk directory walker with dua-core
- Refresh the vendored dependencies. The licence set is unchanged:
re-derived over the new vendor tree, uluru (MPL-2.0) is still the only copyleft crate linked into the binaries, and the new dua-core dependency is MIT.
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected gitoxide package.See Also
Plugin Details
Severity: Medium
ID: 370426
File Name: openSUSE-2026-22126-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 10/22/2026
Updated: 10/22/2026
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 8.02
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-91986
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:gitoxide
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 10/19/2026
Vulnerability Publication Date: 9/15/2026
Reference Information
CVE: CVE-2026-91986