Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
71 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server. All installations with repository upload enabled (default) are affected. Patches File deletions are prohibited to repository's .git directory. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930/ For more information If you have any questions or comments about this advisory, please post on #7000.
Recommended action: Upgrade to 0.12.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact DisplayName allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list. Patches DisplayName is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds Check and update the existing users' display names that contain malicious characters. References N/A For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.
Recommended action: Upgrade to 0.12.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with repository upload enabled (default) are affected. Patches Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/ For more information If you have any questions or comments about this advisory, please post on #7001.
Recommended action: Upgrade to 0.12.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected. Patches Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds Run Gogs in its own private network. References https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/ For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.
Recommended action: Upgrade to 0.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to update a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected. Patches Repository file updates are prohibited to its .git directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds N/A References N/A For more information If you have any questions or comments about this advisory, please post on #6555.
Recommended action: Upgrade to 0.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected. Patches Repository file uploads are prohibited to its .git directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds Disable repository files upload. References https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/ For more information If you have any questions or comments about this advisory, please post on #6968.
Recommended action: Upgrade to 0.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self. Patches Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds No need for workarounds. References N/A For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.
Recommended action: Upgrade to 0.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG (text/xml) files as issue attachments (non-default) are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev. Workarounds Disable uploading SVG files (text/xml) as issue attachments. References https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/ For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.
Recommended action: Upgrade to 0.12.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go gogs.io/gogs < 0.11.80-0.20181218063808-ff93d9dbda5c
Fixed in
0.11.80-0.20181218063808-ff93d9dbda5c· Vendor fix available
Issue
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
Recommended action: Upgrade to 0.11.80-0.20181218063808-ff93d9dbda5c (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected. Patches Repository file uploads are prohibited to its .git directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev. Workarounds Disable repository files upload. References https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/ For more information If you have any questions or comments about this advisory, please post on #6833.
Recommended action: Upgrade to 0.12.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Workarounds In addition to marking PAM accounts as expired, also disable/lock them. Running usermod -L <username will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. References https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/ For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Recommended action: Upgrade to 0.12.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Patches Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Workarounds Run Gogs in its own private network. References https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/ For more information If you have any questions or comments about this advisory, please post on #6754.
Recommended action: Upgrade to 0.12.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
Recommended action: Upgrade to 0.12.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go.
Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check.
Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
Recommended action: Upgrade to 0.11.91 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.