> Gitea is protected against both of these issues.
replyIs Gitea's immunity just incidental because it was written by a different person, or is it due to a deliberate defensive system that prevents such bug/mistake from occurring?
Very interested in knowing too, since the issues seems to not be related at all, or similar, so now this must mean a Gitea "project leader" would only say this if they have some sort of layer that doesn't require them to manually patch issues individually. Meaning, firewall? Would be weird if that's built-in into Gitea though... Hmm.
replyIt looks like Gitea made the same fix (rm -r .git after template processing) back in February: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2b...
replyPR: https://github.com/go-gitea/gitea/pull/36734
So likely Gitea < 1.25.5 was vulnerable.
i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix
replyIt’s explicitly listed as a security fix in the release notes, accompanied by a CVE: https://blog.gitea.com/release-of-1.25.5/
replyIt is unfortunate nobody tipped anyone off downstream.
replygiven the fact that they communicated about this as a CVE, and Forgejo is a fork of gitea, one could say that this is on Forgejo though.
replyYour note is really important! Thanks for adding it. None of us are perfect.
replydeleted
replydeleted
reply