GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:21584-1

Vulnerability from csaf_opensuse - Published: 2026-08-14 15:43 - Updated: 2026-09-17 17:41
Summary
Security update for git-cliff
Severity
Important
Notes
Title of the patch: Security update for git-cliff
Description of the patch: This update for git-cliff fixes the following issues: Changes in git-cliff: - Update to version 2.13.1: * Support more configuration file locations * Add per-commit statistics * Expose determined bump type in release context * Add configurable commit processing order * Add environment variable for offline execution * Migrate logging to tracing * Add caching where applicable - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (boo#1274523) - Update to version 2.12.0: * Add offline flag * Add --skip-tags cli argument * Implement commit processing summary * Bug Fixes - includes changes from 2.11.0: * Support failing on unmatched commits * Add support for azure devops * Improve repository/directory path resolution * Add split_regex, replace_regex, find_regex filters * Bug Fixes - includes changes from 2.10.1: * Add 'integrations' feature flag for enabling all integrations * Bug Fixes * CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (boo#1248065) - Update to version 2.10.0: * (config) Support using include and exclude paths in the config (#1173) - (7c2f922) * (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea) * (template) Support adding commit statistics to the changelog (#1151) - (05a50d7) * (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e) * (config) Check if commit.footers is defined in detailed example (#1170) - (078545f) * (fixtures) Update expected.md after config change (#1176) - (76d3e81) * (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66) * (repo) Use the correct order while diffing paths (#1188) - (ff6c310) * (ci) Apply security best practices (#1180) - (a32deca) * (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e) * (test) Standardize unit tests for commit module (#1147) - (0446d6a) * (context) Add example usage for statistics (#1162) - (4f7379a) * (quickstart) Remove repetitive words (#1200) - (434f9ee) * (readme) Fix twitter badge (#1164) - (68bd85e) * (readme) Polish badges (#1159) - (941cc2b) * (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc) * (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9) * (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf) * (formatting) Use spaces instead of tabs (#1184) - (0027300) * (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08) * (build) Bump MSRV to 1.85.1 - (d8279d4) * (cd) Use macos-15 runner - (c156fc5) * (cd) Re-enable sccache for maturin - (871c3c9) * (crate) Remove Rust nightly requirement - (4f3e5af) * (fixture) Update test-regex-json-array fixture (#1178) - (95f4056) * (format) Format module imports for readability (#1183) - (6db7d49) * (git) Add .git-blame-ignore-revs - (5b64131) * (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158) * (website) Update the node version - (566c2a1) * Check if commit.footers is defined in detailed example (#1170) (078545f) * (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e) * Update expected.md after config change (#1176) (76d3e81) * Use the correct order while diffing paths (#1188) (ff6c310) * Ensure skip_tags condition is evaluated first (#1190) (318be66) * Polish badges (#1159) (941cc2b) * Fix twitter badge (#1164) (68bd85e) * Fix inconsistency in remote integration documentation (#1165) (deb29dc) * Add example usage for statistics (#1162) (4f7379a) * Remove repetitive words (#1200) (434f9ee) * Add installation instructions for gentoo-linux (#1203) (07fe6bf) * Add highlights for 2.10.0 (#1225) (a3fe8c9) * Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea) * Support using include and exclude paths in the config (#1173) (7c2f922) * Support adding commit statistics to the changelog (#1151) (05a50d7) * Bump git-cliff to 2.9.1 (#1156) (e13b158) * Re-enable sccache for maturin (871c3c9) * Update test-regex-json-array fixture (#1178) (95f4056) * Format module imports for readability (#1183) (6db7d49) * Use macos-15 runner (c156fc5) * Update the node version (566c2a1) * Remove Rust nightly requirement (4f3e5af) * Bump MSRV to 1.85.1 (d8279d4) * Add .git-blame-ignore-revs (5b64131) * Standardize unit tests for commit module (#1147) (0446d6a) * Resolve mismatched lifetime syntax warnings (#1167) (9970402) * Implement FromStr instead of Config::parse_from_str() (#1185) (692345e) * Apply security best practices (#1180) (a32deca) * Use spaces instead of tabs (#1184) (0027300) * Add test fixture for overriding the conventional scope (#1166) (cb84a08) - Update to version 2.9.1: * CI/CD fixes only - Update to version 2.9.0: * chore(release): prepare for v2.9.0 * docs(website): add highlights for 2.9.0 (#1153) * chore(deps-dev): bump typescript in /website in the patch group (#1139) * chore(docs): fix some typos (#1149) * fix(template): correctly serialize JSON for the commit fields (#1145) * docs(security): extend security policy (#1142) * chore(deps): bump the minor group in /website with 2 updates (#1116) * refactor(lint): apply clippy suggestions * feat(context): add release commit range (#1138) * fix(submodules): fix submodules handling when using custom range (#1136) * docs(config): fix typo on commit.links (#1132) * chore(deps): upgrade dependencies (#1129) * chore(project): migrate to Rust 2024 edition (#1128) * feat(changelog): support recursing into submodules (#1082) * feat(remote): fetch commits from non-default branches using remotes (#1086) * feat(git): support disabling sorting commits topologically (#804) (#1121) * refactor(config): initialize config structs with default values (#1090) * chore(dependabot): make dependency updates less noisy * chore(dependabot): check dependency updates weekly * fix(bump): check the next version against tag_pattern regex (#1070) * feat(config): support configuring with a remote URL (#1083) * fix(fixtures): evaluate the rc of git-cliff correctly (#1104) * fix(bump): accept lowercase values for bump_type config (#1101) * docs(readme): add blog posts from the community (#1102) * fix(fixtures): use the correct syntax while checking fixture results (#1099) * docs(website): remove references of tj-actions (#1097) * feat(config): add `require_conventional` option (#1061) * docs(release): fix Docker Hub URL * refactor(lint): use IOError::other (#1074) * doc(config): update comments for all configuration options (#1057) * docs(quickstart): clarify git-cliff command (#1051) * fix(git): handle worktrees while retrieving the path of repository (#1054) * chore(npm): update yarn.lock * fix(remote): fix detection of GitLab merge request sha if commits were squashed (#1043) * fix(deps): make glob dependency mandatory (#1035) - Update to version 2.8.0: * cli: Support initializing config with a custom filename * config: Discover the configuration file when run in a sub directory * git: Improve the set commit range error * monorepo: Automatically set include-path for current directory * remote: Support enabling native TLS * repo: Allow running from sub directories * config: Allow environment overwrites when using builtin config * fixtures: Update the arguments for custom GitLab API fixture test * monorepo: Do not set include-path if workdir is set * remote: Fix detection of GitLab merge request sha * lib: Add changelog modifier callback to run function * lint: Use a shared lint config for the workspace * lint: Apply clippy suggestions * docker: Fix typo in comment * highlights: Add link to the Nix flake * jujutsu: Update links to the upstream documentation * lib: Allow doc lint * license: Update copyright years * tips: Extend the merge commit filter example * website: Add highlights for 2.8.0 * fixture: Add fixture for include-path * build: Bump MSRV to 1.83.0 * lint: Allow false positive lint - Update to version 2.7.0: * refactor(clippy): apply clippy suggestions * chore(deps): bump dependencies * chore(integration): remove experimental feature disclaimer * feat(config): allow overriding the remote API URL via config * docs(git): improve docs for commit_preprocessors and commit_parsers * feat(jujutsu): add jujustu support * perf(test): don't create regex inside a loop * chore(log): add trace log about which command is being run * fix(remote): preserve first time contributors * test(git): find upstream remote when using ssh * docs(readme): add blog post about git-cliff * chore(config): add the 'other' parser to the default config * fix(changelog): fix missing commit fields in context * refactor(clippy): apply clippy suggestions * test(repo): expand unit tests of the repo module * fix(changelog): include the root commit when `--latest` is used with one tag * chore(deps): bump clap from 4.5.18 to 4.5.19 * feat(args): add color to the help text * chore(release): prepare for v2.6.1 * refactor(clippy): apply doc_markdown and ignored_unit_patterns lint * chore(fixtures): build binaries using dev profile * refactor(clippy): apply if_not_else lint * fix(remote): avoid setting multiple remotes * chore(deps): bump thiserror from 1.0.63 to 1.0.64 * refactor(clippy): apply assigning_clones lint * refactor(clippy): apply single_match_else lint * refactor(clippy): apply needless_pass_by_value lint * chore(release): prepare for v2.6.0 * feat(config): add changelog.render_always option * chore(deps): bump dependencies * fix(changelog): do not change the tag date if tag already exists * feat(config): allow configuring output file from config * docs(args): fix copy-paste mistake where gitea mentioned gitlab * fix(commit): trim the trailing newline for git2 commits * fix(bump): suppress template warning when `--bumped-version` is used * refactor(clippy): apply explicit_iter_loop lint * refactor(clippy): apply manual_is_variant_and lint * chore(deps): bump clap_complete from 4.5.23 to 4.5.28 * chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 in /website in the minor group * chore(deps): bump pretty_assertions from 1.4.0 to 1.4.1 * fix(changelog): correctly set the tag message for the latest release * refactor(clippy): apply case_sensitive_file_extension_comparisons lint * refactor(clippy): apply clippy suggestions * refactor(clippy): apply option_as_ref_cloned lint * refactor(template)!: add name parameter to the constructor * fix(core): avoid the unnecessary loop when no remote feature is activated * feat(core): add `remote` to commit and deprecate fields * refactor(clippy): apply semicolon_if_nothing_returned clippy lint * refactor(clippy): apply unnested_or_patterns clippy lint * docs(contributing): mention fetching the tags for running tests successfully * fix(args): support using use_branch_tags from both config and args * feat(changelog): support generating changelog for different branches * chore(examples): improve example templates * chore(lib): fix typos in code comments * chore(deps): bump prism-react-renderer from 2.3.1 to 2.4.0 in /website in the minor group * fix(template): resolve parsing issues with `raw`/`endraw` in Jinja * fix(changelog): don't change the context when provided via `--from-context`
Patchnames: openSUSE-Leap-16.0-packagehub-493
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-55159
5.8 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-25541
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 7 products, the same list as for CVE-2025-55159
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for git-cliff",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for git-cliff fixes the following issues:\n\nChanges in git-cliff:\n\n- Update to version 2.13.1:\n  * Support more configuration file locations\n  * Add per-commit statistics\n  * Expose determined bump type in release context\n  * Add configurable commit processing order\n  * Add environment variable for offline execution\n  * Migrate logging to tracing\n  * Add caching where applicable\n- CVE-2026-25541: bytes: integer overflow in \u0027BytesMut:reserve\u0027 can\n  lead to undefined behavior and crashes (boo#1274523)\n\n- Update to version 2.12.0:\n  * Add offline flag\n  * Add --skip-tags cli argument\n  * Implement commit processing summary\n  * Bug Fixes\n- includes changes from 2.11.0:\n  * Support failing on unmatched commits\n  * Add support for azure devops\n  * Improve repository/directory path resolution\n  * Add split_regex, replace_regex, find_regex filters\n  * Bug Fixes\n- includes changes from 2.10.1:\n  * Add \u0027integrations\u0027 feature flag for enabling all integrations\n  * Bug Fixes\n  * CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut\n    function can lead to undefined behavior or potential crash due\n    to out-of-bounds access (boo#1248065)\n\n- Update to version 2.10.0:\n  * (config) Support using include and exclude paths in the config (#1173) - (7c2f922)\n  * (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea)\n  * (template) Support adding commit statistics to the changelog (#1151) - (05a50d7)\n  * (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e)\n  * (config) Check if commit.footers is defined in detailed example (#1170) - (078545f)\n  * (fixtures) Update expected.md after config change (#1176) - (76d3e81)\n  * (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66)\n  * (repo) Use the correct order while diffing paths (#1188) - (ff6c310)\n  * (ci) Apply security best practices (#1180) - (a32deca)\n  * (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e)\n  * (test) Standardize unit tests for commit module (#1147) - (0446d6a)\n  * (context) Add example usage for statistics (#1162) - (4f7379a)\n  * (quickstart) Remove repetitive words (#1200) - (434f9ee)\n  * (readme) Fix twitter badge (#1164) - (68bd85e)\n  * (readme) Polish badges (#1159) - (941cc2b)\n  * (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc)\n  * (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9)\n  * (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf)\n  * (formatting) Use spaces instead of tabs (#1184) - (0027300)\n  * (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08)\n  * (build) Bump MSRV to 1.85.1 - (d8279d4)\n  * (cd) Use macos-15 runner - (c156fc5)\n  * (cd) Re-enable sccache for maturin - (871c3c9)\n  * (crate) Remove Rust nightly requirement - (4f3e5af)\n  * (fixture) Update test-regex-json-array fixture (#1178) - (95f4056)\n  * (format) Format module imports for readability (#1183) - (6db7d49)\n  * (git) Add .git-blame-ignore-revs - (5b64131)\n  * (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158)\n  * (website) Update the node version - (566c2a1)\n  * Check if commit.footers is defined in detailed example (#1170) (078545f)\n  * (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e)\n  * Update expected.md after config change (#1176) (76d3e81)\n  * Use the correct order while diffing paths (#1188) (ff6c310)\n  * Ensure skip_tags condition is evaluated first (#1190) (318be66)\n  * Polish badges (#1159) (941cc2b)\n  * Fix twitter badge (#1164) (68bd85e)\n  * Fix inconsistency in remote integration documentation (#1165) (deb29dc)\n  * Add example usage for statistics (#1162) (4f7379a)\n  * Remove repetitive words (#1200) (434f9ee)\n  * Add installation instructions for gentoo-linux (#1203) (07fe6bf)\n  * Add highlights for 2.10.0 (#1225) (a3fe8c9)\n  * Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea)\n  * Support using include and exclude paths in the config (#1173) (7c2f922)\n  * Support adding commit statistics to the changelog (#1151) (05a50d7)\n  * Bump git-cliff to 2.9.1 (#1156) (e13b158)\n  * Re-enable sccache for maturin (871c3c9)\n  * Update test-regex-json-array fixture (#1178) (95f4056)\n  * Format module imports for readability (#1183) (6db7d49)\n  * Use macos-15 runner (c156fc5)\n  * Update the node version (566c2a1)\n  * Remove Rust nightly requirement (4f3e5af)\n  * Bump MSRV to 1.85.1 (d8279d4)\n  * Add .git-blame-ignore-revs (5b64131)\n  * Standardize unit tests for commit module (#1147) (0446d6a)\n  * Resolve mismatched lifetime syntax warnings (#1167) (9970402)\n  * Implement FromStr instead of Config::parse_from_str() (#1185) (692345e)\n  * Apply security best practices (#1180) (a32deca)\n  * Use spaces instead of tabs (#1184) (0027300)\n  * Add test fixture for overriding the conventional scope (#1166) (cb84a08)\n\n- Update to version 2.9.1:\n  * CI/CD fixes only\n\n- Update to version 2.9.0:\n  * chore(release): prepare for v2.9.0\n  * docs(website): add highlights for 2.9.0 (#1153)\n  * chore(deps-dev): bump typescript in /website in the patch group (#1139)\n  * chore(docs): fix some typos (#1149)\n  * fix(template): correctly serialize JSON for the commit fields (#1145)\n  * docs(security): extend security policy (#1142)\n  * chore(deps): bump the minor group in /website with 2 updates (#1116)\n  * refactor(lint): apply clippy suggestions\n  * feat(context): add release commit range (#1138)\n  * fix(submodules): fix submodules handling when using custom range (#1136)\n  * docs(config): fix typo on commit.links (#1132)\n  * chore(deps): upgrade dependencies (#1129)\n  * chore(project): migrate to Rust 2024 edition (#1128)\n  * feat(changelog): support recursing into submodules (#1082)\n  * feat(remote): fetch commits from non-default branches using remotes (#1086)\n  * feat(git): support disabling sorting commits topologically (#804) (#1121)\n  * refactor(config): initialize config structs with default values (#1090)\n  * chore(dependabot): make dependency updates less noisy\n  * chore(dependabot): check dependency updates weekly\n  * fix(bump): check the next version against tag_pattern regex (#1070)\n  * feat(config): support configuring with a remote URL (#1083)\n  * fix(fixtures): evaluate the rc of git-cliff correctly (#1104)\n  * fix(bump): accept lowercase values for bump_type config (#1101)\n  * docs(readme): add blog posts from the community (#1102)\n  * fix(fixtures): use the correct syntax while checking fixture results (#1099)\n  * docs(website): remove references of tj-actions (#1097)\n  * feat(config): add `require_conventional` option (#1061)\n  * docs(release): fix Docker Hub URL\n  * refactor(lint): use IOError::other (#1074)\n  * doc(config): update comments for all configuration options (#1057)\n  * docs(quickstart): clarify git-cliff command (#1051)\n  * fix(git): handle worktrees while retrieving the path of repository (#1054)\n  * chore(npm): update yarn.lock\n  * fix(remote): fix detection of GitLab merge request sha if commits were squashed (#1043)\n  * fix(deps): make glob dependency mandatory (#1035)\n\n- Update to version 2.8.0:\n  * cli: Support initializing config with a custom filename\n  * config: Discover the configuration file when run in a sub directory\n  * git: Improve the set commit range error\n  * monorepo: Automatically set include-path for current directory\n  * remote: Support enabling native TLS\n  * repo: Allow running from sub directories\n  * config: Allow environment overwrites when using builtin config\n  * fixtures: Update the arguments for custom GitLab API fixture test\n  * monorepo: Do not set include-path if workdir is set\n  * remote: Fix detection of GitLab merge request sha\n  * lib: Add changelog modifier callback to run function\n  * lint: Use a shared lint config for the workspace\n  * lint: Apply clippy suggestions\n  * docker: Fix typo in comment\n  * highlights: Add link to the Nix flake\n  * jujutsu: Update links to the upstream documentation\n  * lib: Allow doc lint\n  * license: Update copyright years\n  * tips: Extend the merge commit filter example\n  * website: Add highlights for 2.8.0\n  * fixture: Add fixture for include-path\n  * build: Bump MSRV to 1.83.0\n  * lint: Allow false positive lint\n\n- Update to version 2.7.0:\n  * refactor(clippy): apply clippy suggestions\n  * chore(deps): bump dependencies\n  * chore(integration): remove experimental feature disclaimer\n  * feat(config): allow overriding the remote API URL via config\n  * docs(git): improve docs for commit_preprocessors and commit_parsers\n  * feat(jujutsu): add jujustu support\n  * perf(test): don\u0027t create regex inside a loop\n  * chore(log): add trace log about which command is being run\n  * fix(remote): preserve first time contributors\n  * test(git): find upstream remote when using ssh\n  * docs(readme): add blog post about git-cliff\n  * chore(config): add the \u0027other\u0027 parser to the default config\n  * fix(changelog): fix missing commit fields in context\n  * refactor(clippy): apply clippy suggestions\n  * test(repo): expand unit tests of the repo module\n  * fix(changelog): include the root commit when `--latest` is used with one tag\n  * chore(deps): bump clap from 4.5.18 to 4.5.19\n  * feat(args): add color to the help text\n  * chore(release): prepare for v2.6.1\n  * refactor(clippy): apply doc_markdown and ignored_unit_patterns lint\n  * chore(fixtures): build binaries using dev profile\n  * refactor(clippy): apply if_not_else lint\n  * fix(remote): avoid setting multiple remotes\n  * chore(deps): bump thiserror from 1.0.63 to 1.0.64\n  * refactor(clippy): apply assigning_clones lint\n  * refactor(clippy): apply single_match_else lint\n  * refactor(clippy): apply needless_pass_by_value lint\n  * chore(release): prepare for v2.6.0\n  * feat(config): add changelog.render_always option\n  * chore(deps): bump dependencies\n  * fix(changelog): do not change the tag date if tag already exists\n  * feat(config): allow configuring output file from config\n  * docs(args): fix copy-paste mistake where gitea mentioned gitlab\n  * fix(commit): trim the trailing newline for git2 commits\n  * fix(bump): suppress template warning when `--bumped-version` is used\n  * refactor(clippy): apply explicit_iter_loop lint\n  * refactor(clippy): apply manual_is_variant_and lint\n  * chore(deps): bump clap_complete from 4.5.23 to 4.5.28\n  * chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 in /website in the minor group\n  * chore(deps): bump pretty_assertions from 1.4.0 to 1.4.1\n  * fix(changelog): correctly set the tag message for the latest release\n  * refactor(clippy): apply case_sensitive_file_extension_comparisons lint\n  * refactor(clippy): apply clippy suggestions\n  * refactor(clippy): apply option_as_ref_cloned lint\n  * refactor(template)!: add name parameter to the constructor\n  * fix(core): avoid the unnecessary loop when no remote feature is activated\n  * feat(core): add `remote` to commit and deprecate fields\n  * refactor(clippy): apply semicolon_if_nothing_returned clippy lint\n  * refactor(clippy): apply unnested_or_patterns clippy lint\n  * docs(contributing): mention fetching the tags for running tests successfully\n  * fix(args): support using use_branch_tags from both config and args\n  * feat(changelog): support generating changelog for different branches\n  * chore(examples): improve example templates\n  * chore(lib): fix typos in code comments\n  * chore(deps): bump prism-react-renderer from 2.3.1 to 2.4.0 in /website in the minor group\n  * fix(template): resolve parsing issues with `raw`/`endraw` in Jinja\n  * fix(changelog): don\u0027t change the context when provided via `--from-context`\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-493",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21584-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248065",
        "url": "https://bugzilla.suse.com/1248065"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1274523",
        "url": "https://bugzilla.suse.com/1274523"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55159 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55159/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25541 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25541/"
      }
    ],
    "title": "Security update for git-cliff",
    "tracking": {
      "current_release_date": "2026-09-17T17:41:52Z",
      "generator": {
        "date": "2026-08-14T15:43:56Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21584-1",
      "initial_release_date": "2026-08-14T15:43:56Z",
      "revision_history": [
        {
          "date": "2026-08-14T15:43:56Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:45:14Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:46:31Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:41:52Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-cliff-0:2.13.1-bp160.1.1.aarch64",
                "product": {
                  "name": "git-cliff-0:2.13.1-bp160.1.1.aarch64",
                  "product_id": "git-cliff-0:2.13.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff@2.13.1-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
                "product": {
                  "name": "git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_id": "git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff-bash-completion@2.13.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
                "product": {
                  "name": "git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_id": "git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff-fish-completion@2.13.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch",
                "product": {
                  "name": "git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_id": "git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff-zsh-completion@2.13.1-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-cliff-0:2.13.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "git-cliff-0:2.13.1-bp160.1.1.ppc64le",
                  "product_id": "git-cliff-0:2.13.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff@2.13.1-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-cliff-0:2.13.1-bp160.1.1.s390x",
                "product": {
                  "name": "git-cliff-0:2.13.1-bp160.1.1.s390x",
                  "product_id": "git-cliff-0:2.13.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff@2.13.1-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-cliff-0:2.13.1-bp160.1.1.x86_64",
                "product": {
                  "name": "git-cliff-0:2.13.1-bp160.1.1.x86_64",
                  "product_id": "git-cliff-0:2.13.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-cliff@2.13.1-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-0:2.13.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64"
        },
        "product_reference": "git-cliff-0:2.13.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-0:2.13.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le"
        },
        "product_reference": "git-cliff-0:2.13.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-0:2.13.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x"
        },
        "product_reference": "git-cliff-0:2.13.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-0:2.13.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64"
        },
        "product_reference": "git-cliff-0:2.13.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch"
        },
        "product_reference": "git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch"
        },
        "product_reference": "git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
        },
        "product_reference": "git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55159",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55159"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0027s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0027s actual length.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55159",
          "url": "https://www.suse.com/security/cve/CVE-2025-55159"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248000 for CVE-2025-55159",
          "url": "https://bugzilla.suse.com/1248000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-14T15:43:56Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55159"
    },
    {
      "cve": "CVE-2026-25541",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25541"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25541",
          "url": "https://www.suse.com/security/cve/CVE-2026-25541"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271347 for CVE-2026-25541",
          "url": "https://bugzilla.suse.com/1271347"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-cliff-0:2.13.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:git-cliff-bash-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-fish-completion-0:2.13.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:git-cliff-zsh-completion-0:2.13.1-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-14T15:43:56Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25541"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.