2024-12-23
Version: All versions before 0.13.1 or 0.14.0+dev
Vulnerability: Unintended Git options ignored for creating tags
Severity: Critical
date: 2024-XX-XX
: An unprivileged user with SSH key can read arbitrary files on the system including database credentials, TLS certificates and other users’ repositories.
What Undercode Says:
This vulnerability allows unauthorized users to read sensitive information on the system. This can be exploited by attackers to gain access to confidential data such as database credentials, TLS certificates, and other users’ repositories.
There is no workaround for this vulnerability. Users are advised to upgrade to Gogs version 0.13.1 or the latest 0.14.0+dev.
This vulnerability was identified in all versions of Gogs before 0.13.1 or 0.14.0+dev. Upgrading to a patched version is the only way to mitigate this risk.
It is important to note that this vulnerability only affects Gogs instances that are accessible via SSH. If you are not using SSH to access your Gogs instance, then you are not affected by this vulnerability.
Users should also take steps to restrict access to their Gogs instance to trusted users only. This will help to mitigate the risk of unauthorized access, even if this vulnerability is not exploited.
By following these recommendations, users can help to protect their Gogs instance from unauthorized access and data breaches.
References:
Reported By: Github.com
Undercode AI: https://ai.undercodetesting.com
Image Source:
OpenAI: https://openai.com
Undercode AI DI v2: https://ai.undercode.help