Public bug reported:
A new release of libgit2 is available for merging from Debian.
Ubuntu: 1.9.6+ds-1ubuntu2
Debian Unstable: 1.9.7+ds-1
### New Debian Changes ###
libgit2 (1.9.7+ds-1) unstable; urgency=medium
* New upstream version 1.9.7+ds
- Fix CVE-2026-5917: shell command injection vulnerability
(Closes: #1144465)
-- Timo Röhling <[email protected]> Sun, 16 Aug 2026 14:38:25 +0200
### Old Ubuntu Delta ###
libgit2 (1.9.6+ds-1ubuntu2) stonking; urgency=medium
* SECURITY UPDATE: Remote code execution via SSH backend
- debian/patches/CVE-2026-5917.patch: Escape repo path in
src/libgit2/transports/ssh_libssh2.c
- CVE-2026-5917
-- Kyle Kernick <[email protected]> Mon, 21 Sep 2026 13:58:53
-0600
libgit2 (1.9.6+ds-1ubuntu1) stonking; urgency=medium
* Merge with Debian Unstable. Remaining changes:
- Vendor llhttp within package (LP #2080872)
- d/t/control: use cmake:native
-- Simon Quigley <[email protected]> Sat, 01 Aug 2026 12:01:08 -0500
** Affects: libgit2 (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: libgit2 (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: libgit2 (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171224
Title:
Merge libgit2 1.9.7+ds-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libgit2/+bug/2171224/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
