-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 12 Oct 2026 09:06:59 -0500 Source: libgit2 Architecture: source Version: 1.5.1+ds-1+deb12u2 Distribution: bookworm-security Urgency: high Maintainer: Utkarsh Gupta <utkarsh@debian.org> Changed-By: Simon Quigley <tsimonq2@debian.org> Closes: 1144465 Changes: libgit2 (1.5.1+ds-1+deb12u2) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-53584: Reject path traversal in submodule paths read from .gitmodules. * CVE-2026-53585: Limit the size of objects produced by delta application (2 GiB by default) to prevent memory exhaustion. * CVE-2026-53586: Pass the current host to the credential callback after an HTTP redirect. * CVE-2026-5917: Escape the repository path in the SSH remote command to prevent shell command injection. (Closes: #1144465) Checksums-Sha1: ba22789e255d8e0bf9a1320f02e0fd689839eac4 2286 libgit2_1.5.1+ds-1+deb12u2.dsc 7149c2d93e69fbaed9f299d6204623255156293f 25624 libgit2_1.5.1+ds-1+deb12u2.debian.tar.xz bbf64af0101be345a061518a963a2652bb7d903d 8274 libgit2_1.5.1+ds-1+deb12u2_source.buildinfo Checksums-Sha256: 6509ddc297cdfe2140540121f09108e98f0f3a4e2d04077bb409cee6d8316649 2286 libgit2_1.5.1+ds-1+deb12u2.dsc 6a05d338adb95329616650f71d9cb3622d2e7c4a8f2767b7bbf08c36eb87e284 25624 libgit2_1.5.1+ds-1+deb12u2.debian.tar.xz 896298305d00221f1eff585d99c1bcb8e9740852d7a14b9045dab6d95a7515ec 8274 libgit2_1.5.1+ds-1+deb12u2_source.buildinfo Files: ff933fb06a206bf34c3873d9972b46ed 2286 libs optional libgit2_1.5.1+ds-1+deb12u2.dsc 1897742f87e6a60f32d338c3432e41f9 25624 libs optional libgit2_1.5.1+ds-1+deb12u2.debian.tar.xz 8fd23e733cd8e4772c33c8dd56709411 8274 libs optional libgit2_1.5.1+ds-1+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrM7ZkACgkQ4n8s+EWM L6QTPw/8CL8pw2AaijFchLYMr6mK2xfON2o+fHoeXBocmol4wS0+VLk/7PLOx0pa tyhNvuu8jWZzzoutUKEpizBnL5vjoc1VhU8c1/a267pOWhXFY/3tZCcK/Udgrccw B/DyZpTOOVs3i0crZywnSt/pFwm9CnwpJITqyE1xHny+Y9kBZHfSfLjzv8a7Ozp3 J58cjmsYec7gquTy+y3TJd/HY+zgJl/X7wkJPMAFoIgPpwb+vZSvTEJ2RYf4PH4Q g61wMxEF1JQKz44CZP7D668S2lFBqjAswCaftwNwtGCqMxO9zicS0u+7zeTWGZE+ 5Fgn3hz8cYPSh1X1FQbAmSTcJtNrRTEPXkjj29vQLhl16pkWj3LT3IpNxtOMlUfQ qBLMKLjjV5eWBEtV8d/o7K4iyOpBxxwrehYYab34JXwWsHiQ+5qfFDupJq2IFgGL svxRA4O2SoR95lcEtcHcKMYW65oGZz/h/PQcg8PevTCGpaBe1DZYX77PRP1JJShj bisGTd2GKwR4+tLnojywE9oPsz84iepqrYwmpBFhu8w2JxeD1zBf2DDaj1/zGnNA jMzvFZ3O6Vhwa0ER2/cAjmsHfMNBkCtg2iIpsrIU6u7WvQluvGHh/JY6ef+3MNDG N5mgOzjC6kxoAfKJs5bPQHaOChRmRbfRsNabtNn2AqUwa2efU/M= =D2hF -----END PGP SIGNATURE-----
