3 ms·

It looks like Gitea made the same fix (rm -r .git after template processing) back in February: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2bc3f3a

by Macha 23d ago

It looks like Gitea made the same fix (rm -r .git after template processing) back in February: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2bc3f3a9066020cc674f6b1#diff-491170640d4be1e5b696640c6d39f42b264825691b955aaa175935e182e9f0da# https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2b... PR: https://github.com/go-gitea/gitea/pull/36734 https://github.com/go-gitea/gitea/pull/36734 So likely Gitea < 1.25.5 was vulnerable.

fartfeatures 23d ago
It is unfortunate nobody tipped anyone off downstream.
- vanschelven 22d ago
  given the fact that they communicated about this as a CVE, and Forgejo is a fork of gitea, one could say that this is on Forgejo though.
  - fartfeatures 21d ago
    Agreed, I didn't realise there had been a CVE.
- dust-jacket 22d ago
  CVE AND release note not enough tipping off for you? it is absolutely not on maintainers of projects to proactively notify those who've forked the project. clear and transparent notices are exactly the right approach
  - fartfeatures 21d ago
    Apologies I didn't see there had been a CVE. I completely retract my statement.
ntauthority 22d ago
i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix
- wvbdmp 22d ago
  It’s explicitly listed as a security fix in the release notes, accompanied by a CVE: https://blog.gitea.com/release-of-1.25.5/ https://blog.gitea.com/release-of-1.25.5/
- tomxor 22d ago
  I'm not completely sure if this is supposed to be sincere, but it should be. It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.
embedding-shape 22d ago
So not "Gitea is protected against both of these issues" but "Gitea fixed these issues earlier", which kind of feels like a less marketing-friendly version of what the Gitea employee said above. Why people can't just talk clearly and not try to oversell whatever they're doing? It's a disease at this point.

by Macha 23d ago

fartfeatures 23d ago

It is unfortunate nobody tipped anyone off downstream.

vanschelven 22d ago
given the fact that they communicated about this as a CVE, and Forgejo is a fork of gitea, one could say that this is on Forgejo though.
- fartfeatures 21d ago
  Agreed, I didn't realise there had been a CVE.
dust-jacket 22d ago
CVE AND release note not enough tipping off for you? it is absolutely not on maintainers of projects to proactively notify those who've forked the project. clear and transparent notices are exactly the right approach
- fartfeatures 21d ago
  Apologies I didn't see there had been a CVE. I completely retract my statement.

ntauthority 22d ago

i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix

wvbdmp 22d ago
It’s explicitly listed as a security fix in the release notes, accompanied by a CVE: https://blog.gitea.com/release-of-1.25.5/ https://blog.gitea.com/release-of-1.25.5/
tomxor 22d ago
I'm not completely sure if this is supposed to be sincere, but it should be. It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.

embedding-shape 22d ago

So not "Gitea is protected against both of these issues" but "Gitea fixed these issues earlier", which kind of feels like a less marketing-friendly version of what the Gitea employee said above. Why people can't just talk clearly and not try to oversell whatever they're doing? It's a disease at this point.