Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - gitoxide 是用 Rust 编写的 git 实现。在 0.42.0之前版本中gitoxide 使用 SHA-1 哈希实现而不进行任何冲突检测因此容易受到哈希冲突攻击。 gitoxide 使用 sha1_sbol 或 sha1 板条箱其两者皆实现标准 SHA-1而无任何冲突攻击缓解措施。这意味着具有冲突 SHA-1 哈希的两个不同 Git 对象在与 gitoxide 使用时会破坏 Git 对象模型和完整性检查。此漏洞已在 0.42.0 中修复。
    (CVE-2025-31130)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - gitoxide 是一個以 Rust 撰寫的 git 實作。在 0.42.0之前的版本中gitoxide 會使用沒有任何衝突偵測的 SHA-1 雜湊實作從而容易遭受雜湊衝突攻擊。 gitoxide 使用 sha1_smol 或 sha1 箱兩者皆實作標準 SHA-1而無任何衝突攻擊緩解措施。這表示具有衝突 SHA-1 雜湊的兩個不同 Git 物件在搭配 gitoxide 使用時會中斷 Git 物件模型和完整性檢查。此弱點已在 0.42.0 中修正。
    (CVE-2025-31130)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - gitoxide は Rust で書かれた git の実装です。 0.42.0より前では、gitoxide は衝突検出なしで SHA-1 ハッシュ実装を使用するため、ハッシュ衝突攻撃に脆弱でした。 gitoxide は sha1_smod または sha1 クレートを使用し、どちらも衝突攻撃に対する緩和策なしで標準の SHA-1 を実装します。これは、SHA-1 ハッシュが衝突する 2 つの異なる Git オブジェクトが、gitoxide とともに使用された場合に、Git オブジェクトモデルおよび整合性チェックを破損させることを意味します。この脆弱性は 0.42.0 で修正されています。
    (CVE-2025-31130)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash     implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide     uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for     collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the     Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
    (CVE-2025-31130)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21558-1 advisory.

    Changes in gitoxide:

    - Update to 0.56.0:
      * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules         trust check could be bypassed in gix_submodule::File::update(),         which allowed arbitrary command execution from a crafted         .gitmodules file
      * Fixes a submodule name validation bypass that allowed traversal         out of .git/modules and disclosure of credentials
      * Fixes symlinked .gitmodules files being followed and parsed from         outside the repository
      * Fixes several denial-of-service vectors in gix-pack: unchecked         indexing panics and uncapped allocations from crafted pack data
      * Fixes HTTP credentials being leaked to the redirected host by the         curl transport backend
      * Add the gix config show, gix config list, gix config fmt,         gix free remote refs, gix free trust, gix dirwalk and gix tix         subcommands
      * Add a gix status --untracked flag and gix merge tree --message         for creating commits
      * gix exclude query is now index-aware and no longer reports ignore         matches for tracked files, matching git check-ignore
      * Preserve all configured remote URLs rather than only the last one
      * Fix fetching and cloning with tag refspecs in shallow clones,         relative worktree linking files and loose ref path-prefix         collisions
      * Update the crates to the Rust 2024 edition
    - Refresh the vendored dependencies. Recording the state of the       remaining open CVE bugs against this version, none of which it is       affected by:
      * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1,         above the 1.11.1 fix
      * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far         above the 0.17.0 that fixed the world-writable checkout of         executable files

    - update to 0.50.0:
      see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0

    - update to 0.42.0:
      * add first 'debug' version of gix diff file
      * use revspecs for revision and path
      * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872

    - Update to version 0.41.0:
      * add gix blame -L start,end
      * add gix env to print paths relevant to the Git installation.
      * Document the remaining subcommands
      * Add support for statistics and additional performance         information.
      * add gix blame to the CLI. That way it's possible to see the         blame result of any file in the repository.

    - Updates from version 0.40.0:
      * add first 'debug' version of gix log. It's primarily meant to         better understand gix blame.
      * add --tree-favor to gix merge tree|commit. With it one can         decide which side to favor in case of irreconcilable         tree-conflicts.
      * CVE-2025-22620: gix-worktree-state specifies 0777 permissions         when checking out executable files (boo#1236139)

    - Update to version 0.39.0:
      New Features
      * add gix merge commit --debug
      * add gix merge commits
      * add gix merge tree to merge trees similarly to git merge-tree.

    - Update to version 0.38.0:
      New Features
      * support for listing worktrees with gix worktree list
      * add first 'debug' version of gix diff tree.
      * add new gix cat command.
      * add gix merge-file with similar features as git merge-file
      * gix merge-base for the CLI       Bug Fixes
      * Adjust gix clean warning and help for worktree fix
      * Clarify -r/--repositories and --skip-hidden-repositories       Other
      * switch from time to jiff
      * Unify style in config support info

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
256334	Linux Distros 未修补的漏洞：CVE-2025-31130	Nessus	Misc.	8/27/2025	7/28/2026	medium
256334	Linux Distros 未修補的弱點：CVE-2025-31130	Nessus	Misc.	8/27/2025	7/28/2026	medium
256334	Linux Distros のパッチ未適用の脆弱性: CVE-2025-31130	Nessus	Misc.	8/27/2025	7/28/2026	medium
256334	Linux Distros Unpatched Vulnerability : CVE-2025-31130	Nessus	Misc.	8/27/2025	7/28/2026	medium
335081	openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21558-1)	Nessus	SuSE Local Security Checks	8/13/2026	8/13/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high