It looks like Gitea made the same fix (rm -r .git after template processing) back in February: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2b...
replyPR: https://github.com/go-gitea/gitea/pull/36734
So likely Gitea < 1.25.5 was vulnerable.
So not "Gitea is protected against both of these issues" but "Gitea fixed these issues earlier", which kind of feels like a less marketing-friendly version of what the Gitea employee said above.
replyWhy people can't just talk clearly and not try to oversell whatever they're doing? It's a disease at this point.
i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix
replyIt’s explicitly listed as a security fix in the release notes, accompanied by a CVE: https://blog.gitea.com/release-of-1.25.5/
replyIt is unfortunate nobody tipped anyone off downstream.
replygiven the fact that they communicated about this as a CVE, and Forgejo is a fork of gitea, one could say that this is on Forgejo though.
reply