-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 20 Aug 2026 07:56:57 +0200
Source: libgit2
Binary: libgit2-1.9 libgit2-1.9-dbgsym libgit2-dev
Architecture: amd64
Version: 1.9.0+ds-2+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) <buildd_amd64-x86-ubc-01@buildd.debian.org>
Changed-By: Timo Röhling <roehling@debian.org>
Description:
 libgit2-1.9 - low-level Git library
 libgit2-dev - low-level Git library (development files)
Closes: 1144465
Changes:
 libgit2 (1.9.0+ds-2+deb13u1) trixie-security; urgency=high
 .
   * Fix CVE-2026-5917: shell command injection in SSH transport
     (Closes: #1144465)
   * Fix CVE-2026-53583: inverted cert validity check for IP addresses
   * Fix CVE-2026-53584: unsanitized submodule paths
   * Fix CVE-2026-53585: limit pack object size to 2GiB
   * Fix CVE-2026-53586: pass correct hostname to auth layer after redirect
   * Fix CVE-2026-53587: read buffer overflow in capability check
Checksums-Sha1:
 1a8eee7b2600927558c4aea9b7807780e9234dab 1928608 libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_amd64.deb
 ba6dcb96f22ca65dee958c87556a662438d49842 555732 libgit2-1.9_1.9.0+ds-2+deb13u1_amd64.deb
 597f3523c4678560424fd3e5a3f34d3ddcd93162 846480 libgit2-dev_1.9.0+ds-2+deb13u1_amd64.deb
 7a582d33a8b9939abb1e5c11c1d7babe0f2408c9 8374 libgit2_1.9.0+ds-2+deb13u1_amd64-buildd.buildinfo
Checksums-Sha256:
 7341c7e93400e38e3a520798d2752ff9e6c30c18a26a5b44b3f5d18dc70671e8 1928608 libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_amd64.deb
 2fb4b6503fb8f143a8035077b9de99118326ac2b26565779e71c4648e01e75ee 555732 libgit2-1.9_1.9.0+ds-2+deb13u1_amd64.deb
 d678cd24c112a7b5c452adcdc34fc81f5974aef6cd84c9d45e524d422b694f44 846480 libgit2-dev_1.9.0+ds-2+deb13u1_amd64.deb
 aaa651ef3c1868e78302d512590a871f39125bead75897b79152102ad81b32a7 8374 libgit2_1.9.0+ds-2+deb13u1_amd64-buildd.buildinfo
Files:
 4966995dba4474c3d05728b932551a84 1928608 debug optional libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_amd64.deb
 26e65baa7cb75b45c72c3d5959cbc5da 555732 libs optional libgit2-1.9_1.9.0+ds-2+deb13u1_amd64.deb
 6c2f3c7703e92d8ac23fff1e978aa5d5 846480 libdevel optional libgit2-dev_1.9.0+ds-2+deb13u1_amd64.deb
 9394cc8d55690ac3d06a251227a11566 8374 libs optional libgit2_1.9.0+ds-2+deb13u1_amd64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmqGoaUACgkQTwt/65ON
6zccLxAAojmE+QcnJqaiJwQouM0vuibYOGNphKaIhH6A9iH/I8Ygp6AafiBzhDnH
JdQJ+lM+dEqvf1Zt5oHv/rfttYogrJKZlac0IfOnPPh8ODtBW4gqLZoMqSo6EDN9
KiOBN5c/SNEjmz6cX3TIlqjRHY/OZlDY5Ep83dZKAc8gXEC4Fwf8iHwJ7iNoicyA
I3qtvniAM5yWDMG4oonP0lsea/XAUjWDsB4Eu3WOktO4O6wrqdtO8a/8w6cniU0F
FHZd9pLAwDNi8hCDMQH0HKZHdyC9Osr6in2r3IQ0rNjoddp6af7lniXZxE8kJkrX
DxsQ1sjZA/isTvrclWmDLjqLam9xdtRHq0L7Ak5j60IawEKTh7jRMCvYTYQ1JKrq
DhfkN2mZcXiXbw7ovv0YT9y6SisLZRFlBN2ClgqwRpkaX3VTsRSBMCVo8hlT9Iz4
WEQzA5E2g56RRMpAxf8J61wL5YumKTnNFZJwi8Wj99U8rpQprUkDA5wtMjGJRbh2
lo/SHn9Z349heyARTQCG6SNz5pvIFE1MDSGu6x2vhgQ6muOy823U83kYR4PZtQ5a
FQ0HP0k0to4gnGnK7r2T/HOSWlE+EflDW8AMRLgNLTcOpH+Am3aqUC+eDLuWLQjd
EQxyetAhAyMW8FIfbpSHexeVfGEAjIw6+wR21FfOMKf6nDfvoNQ=
=4CqR
-----END PGP SIGNATURE-----