GitHub Advisoryadvisory · Go

GHSA-56j7-2pm8-rgmx OS Command Injection in gogs

CRITICAL Published 2022-06-02 Modified 2022-06-02 Official page ↗
Aliases
CVE-2021-32546
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Critical
Weaknesses
CWE-78
Reviewed
2022-06-02

Affected packages

• Go gogs.io/gogs: < 0.12.8 → fixed in 0.12.8

Description

Impact The malicious user is able to update a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected. Patches Repository file updates are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. Workarounds N/A References N/A For more information If you have any questions or comments about this advisory, please post on #6555.

Related

Alias · CVE (1)

  • CVE-2021-32546 Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References