Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gh for openSUSE:Factory checked in at 2026-07-21 22:59:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gh (Old) and /work/SRC/openSUSE:Factory/.gh.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gh" Tue Jul 21 22:59:49 2026 rev:99 rq:1366700 version:2.96.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gh/gh.changes 2026-07-08 17:41:59.184863699 +0200 +++ /work/SRC/openSUSE:Factory/.gh.new.24530/gh.changes 2026-07-21 22:59:55.000722688 +0200 @@ -1,0 +2,10 @@ +Fri Jul 17 13:56:05 UTC 2026 - Pavel Dostál <[email protected]> + +- Add gh-CVE-2026-39821-idna-punycode.patch: reject all-ASCII xn-- + Punycode labels in the vendored golang.org/x/net/idna package + regardless of Go's unicode.Version (bsc#1266618, CVE-2026-39821). + Bumping the vendored x/net version alone does not fix this, as the + upstream check is gated behind unicode.Version >= 16.0.0, which our + Go toolchain does not yet report. + +------------------------------------------------------------------- New: ---- gh-CVE-2026-39821-idna-punycode.patch ----------(New B)---------- New: - Add gh-CVE-2026-39821-idna-punycode.patch: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gh.spec ++++++ --- /var/tmp/diff_new_pack.dzQahZ/_old 2026-07-21 22:59:57.108794524 +0200 +++ /var/tmp/diff_new_pack.dzQahZ/_new 2026-07-21 22:59:57.120794934 +0200 @@ -27,6 +27,10 @@ URL: https://cli.github.com/ Source0: %{sname}-%{version}.tar.zst Source1: vendor.tar.gz +# PATCH-FIX-UPSTREAM gh-CVE-2026-39821-idna-punycode.patch bsc#1266618 [email protected] +# Backport of golang.org/x/net commit f05f21be5927155a88b371674c298ada54b71cf5: +# reject all-ASCII xn-- Punycode labels regardless of Go's unicode.Version. +Patch0: gh-CVE-2026-39821-idna-punycode.patch BuildRequires: fish BuildRequires: golang(API) >= 1.26 # This is needed for some tests ++++++ gh-CVE-2026-39821-idna-punycode.patch ++++++ From: Pavel Dostál <[email protected]> Subject: idna: reject all-ASCII xn-- labels regardless of Go's unicode.Version Backported from golang.org/x/net commit f05f21be5927155a88b371674c298ada54b71cf5 ("idna: reject all-ASCII xn-- labels on all Go versions"), fixing CVE-2026-39821 (bsc#1266618). The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label, e.g. ToUnicode("xn--example-.com") incorrectly returns "example.com" instead of an error. The original fix for this (golang.org/x/net commit introducing golang-review 767220) only takes effect when Go's internal unicode.Version is >= 16.0.0. As of the Go toolchain used to build this package, unicode.Version is still 15.0.0, so the check never triggers and the vendored code remains vulnerable regardless of the x/net release used. This patch removes that version gate, matching upstream's follow-up fix. --- a/vendor/golang.org/x/net/idna/idna.go +++ b/vendor/golang.org/x/net/idna/idna.go @@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) { // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
