-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 20 Aug 2026 07:56:57 +0200
Source: libgit2
Binary: libgit2-1.9 libgit2-1.9-dbgsym libgit2-dev
Architecture: i386
Version: 1.9.0+ds-2+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Timo Röhling <roehling@debian.org>
Description:
 libgit2-1.9 - low-level Git library
 libgit2-dev - low-level Git library (development files)
Closes: 1144465
Changes:
 libgit2 (1.9.0+ds-2+deb13u1) trixie-security; urgency=high
 .
   * Fix CVE-2026-5917: shell command injection in SSH transport
     (Closes: #1144465)
   * Fix CVE-2026-53583: inverted cert validity check for IP addresses
   * Fix CVE-2026-53584: unsanitized submodule paths
   * Fix CVE-2026-53585: limit pack object size to 2GiB
   * Fix CVE-2026-53586: pass correct hostname to auth layer after redirect
   * Fix CVE-2026-53587: read buffer overflow in capability check
Checksums-Sha1:
 ab04210c847b8811f59f13346e00706f81711f14 1673644 libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_i386.deb
 be515d170677f279db90dcec2441127d94b5a790 608488 libgit2-1.9_1.9.0+ds-2+deb13u1_i386.deb
 5cf7706231099e7653d1a6996bf93eaaf43b8a13 925868 libgit2-dev_1.9.0+ds-2+deb13u1_i386.deb
 b1b78a3782dc21095e707f851f4983e7f710f119 8272 libgit2_1.9.0+ds-2+deb13u1_i386-buildd.buildinfo
Checksums-Sha256:
 ad80ff34a470d36282d8ff681f44167fc60e664e13a485d64044e3698e30807f 1673644 libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_i386.deb
 d392ff47fe0e7e842fbfac4fab1a5d079d48445d3f398c8b55b9b07e1e6ea97a 608488 libgit2-1.9_1.9.0+ds-2+deb13u1_i386.deb
 b665a8feb9effe3b9a950ae4e0a99e85b0400716c830e4ed08c554ce6291f869 925868 libgit2-dev_1.9.0+ds-2+deb13u1_i386.deb
 f7424f8eadbf48ae66ad5c84df1efbf3d16cdc86e36f785b2c4a1b09015d3acb 8272 libgit2_1.9.0+ds-2+deb13u1_i386-buildd.buildinfo
Files:
 39f69ae8b8450d3e9b529cc80f3e1d99 1673644 debug optional libgit2-1.9-dbgsym_1.9.0+ds-2+deb13u1_i386.deb
 66f0808ca363f779eb9d1ced73c11fc6 608488 libs optional libgit2-1.9_1.9.0+ds-2+deb13u1_i386.deb
 22b84453044c32115152004a212088dd 925868 libdevel optional libgit2-dev_1.9.0+ds-2+deb13u1_i386.deb
 61cf58cf9e73bba713ee0f335520589f 8272 libs optional libgit2_1.9.0+ds-2+deb13u1_i386-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqGobgACgkQPkCWRKsh
20fySQ/+O6yhKnES63vSGOin5JvRhQnXMPcjUdcVg8R26Nhxl+GgoaO/M7MrbvDZ
99y9igQHHnpM69UsX1YgsCLewfSo/3ck55qUCcHYg0jBP4NwmANkW46c5v4swYHK
XJwt+DvlW4NBvijxmm0qM0AArEwJH/10v1Zyykc7Sf0RSKRyoxZa+oP1USeq2MXe
2qHqvqne4MMDUio7StYMdk3oC4+YkSpDSQfyyvlmccsMKux1z7TmgWzobBWIAyU1
4toB9FjWBOKpnBwJM7ZxRIfrJFBpOH/TVrtIvsvtMZGRwkROl2LQP/cewlD+0w85
1ZfpH3svXUwOgPLaZgO8pTAlznH63tFa2por2GKOVIH2hAuK2Im+KWuwsoanlSYw
gKrJTF+xoM0Q7LjRwSDNnrLpfLu4wTQY3cK37s8ARqpLDiPmThVAsq/dzWjzIsHG
eM8yB/s1akitbVYjffGHaXhvvKPtU9Ndlr6ttKdN+haMjvRv5RfCv131FZ0WyJsp
pwPKZzLZEcACCU9CjtEwflJLElUGVSqV7vLHtpK10fopDaI7DkA3SgVo57eQ13cs
OGz9LS6xx8NaZdpulm9ES8/Sn8ATahnS42fAH00iQDQm03gYbqmwA9pGvc7SnXeK
0+t3TIYc0kR4CH4W2M0UPQc6xN9Putj5AncukBl8jWxrvZGlL8s=
=Irxg
-----END PGP SIGNATURE-----