3 ms·

I’m not going to disagree with you on the usage of package managers. No only is it easier to install, but easier to maintain. But, isn’t cgit basically read-on

I’m not going to disagree with you on the usage of package managers. No only is it easier to install, but easier to maintain. But, isn’t cgit basically read-only? If so, that doesn’t seem to be particularly risky. All of the main interactions with gitolite are through SSH, which I’d expect to be the main area of attack.

drdec 6y ago
> But, isn’t cgit basically read-only? So are SELECT statements until little Bobby Tables shows up. Which is to say that SQL injection can be used to turn read-only functionality into write functionality. Secondly, if you care about who has access to the data, even read-only vulnerabilities can be damaging.
- mbreese 6y ago
  True, but exploiting cgit would be significantly more difficult than a SQL injection. I could only find a handful of CVEs for cgit, and the last one was in 2018 (v 1.2.1)[1]. It involved reading files outside the git tree. That said, it's not the common software to see publicly, so probably hasn't been thoroughly vetted. But I think the point still stands that installing from source isn't going to be a horrible security risk. Similarly though -- It is a mature project without a lot of new features. I don't think there are killer features in master that would make me want to install from source over `apt install cgit` [1] https://www.cvedetails.com/vulnerability-list/vendor_id-15775/product_id-33075/Cgit-Project-Cgit.html https://www.cvedetails.com/vulnerability-list/vendor_id-1577...
  - stonesweep 6y ago
    You don't know you have a CVE until you have a CVE, it's not hard to find any given story of bugs being found a decade later with high vulnerability scores. https://securityboulevard.com/2020/07/microsoft-patches-17-year-old-windows-vulnerability-with-cve-10-0-score/ https://securityboulevard.com/2020/07/microsoft-patches-17-y...

drdec 6y ago

> But, isn’t cgit basically read-only? So are SELECT statements until little Bobby Tables shows up. Which is to say that SQL injection can be used to turn read-only functionality into write functionality. Secondly, if you care about who has access to the data, even read-only vulnerabilities can be damaging.

mbreese 6y ago
True, but exploiting cgit would be significantly more difficult than a SQL injection. I could only find a handful of CVEs for cgit, and the last one was in 2018 (v 1.2.1)[1]. It involved reading files outside the git tree. That said, it's not the common software to see publicly, so probably hasn't been thoroughly vetted. But I think the point still stands that installing from source isn't going to be a horrible security risk. Similarly though -- It is a mature project without a lot of new features. I don't think there are killer features in master that would make me want to install from source over `apt install cgit` [1] https://www.cvedetails.com/vulnerability-list/vendor_id-15775/product_id-33075/Cgit-Project-Cgit.html https://www.cvedetails.com/vulnerability-list/vendor_id-1577...
- stonesweep 6y ago
  You don't know you have a CVE until you have a CVE, it's not hard to find any given story of bugs being found a decade later with high vulnerability scores. https://securityboulevard.com/2020/07/microsoft-patches-17-year-old-windows-vulnerability-with-cve-10-0-score/ https://securityboulevard.com/2020/07/microsoft-patches-17-y...