Advisories ยป MGASA-2026-0589

Updated python-dulwich & rust-similar3 packages fixes security vulnerabilities

Publication date: 10 Nov 2026
Modification date: 10 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-47712 , CVE-2026-47734 , CVE-2026-114098 , CVE-2026-114097 , CVE-2026-114095 , CVE-2026-114094 , CVE-2026-114096

Description

Commit subjects not sanitized in ``porcelain.format_patch``
Unbounded memory allocation in receive-pack from crafted thin packs
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability
in stash.py pop() that allows attackers to write arbitrary files outside
the worktree through intermediate directory symlinks. Attackers can
craft a malicious repository whose popped stash writes a payload into
.git/hooks/post-checkout, achieving code execution on the next checkout.
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability
in CommitFilter._apply_index_filter() that allows attackers to write
files outside the working directory via symlinks persisting between
commits. Attackers can craft a repository where an ancestor commit's
symlink redirects a descendant commit's file writes during
filter_branch, enabling code execution by writing into .git/hooks.
Dulwich before 1.2.9 contains a denial of service vulnerability in
Pack.resolve_object that allows attackers to cause infinite recursion
via self-referential OFS_DELTA objects. Attackers can supply a malicious
packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during
clone, fetch, or cat-file operations.
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git
tree path elements on Windows, allowing arbitrary file write. Attackers
can craft a malicious repository with a tree entry named 'C:' that
bypasses NTFS validation and writes files outside the worktree to
achieve remote code execution.
Dulwich from 0.24.0 before 1.2.8 contains a symlink following
vulnerability in porcelain.checkout(paths=[...]) that allows attackers
to write arbitrary files by abusing raw os.open without O_NOFOLLOW.
Attackers can craft a repository where a worktree symlink points to
.git/hooks/post-checkout, so restoring the file from a tag writes a
malicious hook for code execution.

References

SRPMS

10/core