SUSE · Security update for gitea-tea
Affects SUSESource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · fixed in SUSE package updates : patch SUSE soon.
Data as of 10 Nov 2026, 20:06 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Patch
- Available – fixed in 0.15.1
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
Description
This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below (bsc#1253576): * CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing request, fixed by the vendored x/crypto bump to 0.54.0 (fix floor is 0.43.0 per GO-2025-4116) - update to 0.15.1: * f34697c5ed chore(config): replace authgate SDK with signet (#1081) * a613a344de fix(test): disable gpg signing in worktree test repo (#1072) * 6435b12202 chore(deps): pin dependencies (#1064) - update to 0.15.0: * fix(context): clarify the fallback login prompt wording in #1061 * Fix notifications --mine outside git repositories in #1056 * feat(assignees): add set, add, and remove assignees APIs in #1045 * fix(deps): update go dependencies in #1057 * fix(deps): update go dependencies in #1051 * fix(theme): don't query the terminal at start-up in #1054 * upgrade go sdk and add test in #1048 * feat(comments): accept -d/--description for comment body in #1043 * Add reply to code review in #978 * fix(http): add transport timeouts so tea fails fast on stalled servers in #1020 * fix(config): write to keychain before config in #1044 - Update to version 0.14.2: + fix(labels): add org label for ls and pr + fix(oauth): pass resolved redirect_uri to token exchange + feat(pulls): show PR URL in detail view + feat(comments): add list/edit/delete subcommands to tea comment + feat(pulls): add --draft to create and --draft/--ready to edit + fix(pulls): restore standard fork-flow PR creation + fix(comment): don't block on stdin when body is given positionally + docs(login): make the git credential helper discoverable + fix(print): distinguish draft PRs from conflicting PRs + feat: add wiki CLI commands + fix(context): improve local repo detection logic and test
References
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/2026/opensuse-su-2026_21603-1.json (opens in a new tab)
- bugzilla.suse.com/1234598 (opens in a new tab)
- bugzilla.suse.com/1235367 (opens in a new tab)
- bugzilla.suse.com/1239493 (opens in a new tab)
- bugzilla.suse.com/1241819 (opens in a new tab)
- bugzilla.suse.com/1251471 (opens in a new tab)
- bugzilla.suse.com/1251663 (opens in a new tab)
- bugzilla.suse.com/1253576 (opens in a new tab)
- suse.com/security/cve/CVE-2024-45337/ (opens in a new tab)
- suse.com/security/cve/CVE-2024-45338/ (opens in a new tab)
- suse.com/security/cve/CVE-2025-22869/ (opens in a new tab)
- suse.com/security/cve/CVE-2025-22872/ (opens in a new tab)
- suse.com/security/cve/CVE-2025-47911/ (opens in a new tab)
- suse.com/security/cve/CVE-2025-47913/ (opens in a new tab)
- suse.com/security/cve/CVE-2025-58190/ (opens in a new tab)