Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-9hxg-w7qf-hh93 #1967

Closed
GoVulnBot opened this issue Jul 25, 2023 · 2 comments
Closed

x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-9hxg-w7qf-hh93 #1967

GoVulnBot opened this issue Jul 25, 2023 · 2 comments
Assignees
@neild
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-9hxg-w7qf-hh93, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
gogs.io/gogs 0.11.82.1218 < 0.11.82.1218

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: gogs.io/gogs
      versions:
        - fixed: 0.11.82.1218
      packages:
        - package: gogs.io/gogs
summary: Gogs Directory Traversal
description: |-
    In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the
    file-upload functionality can allow an attacker to create a file under
    data/sessions on the server, a similar issue to CVE-2018-18925.
cves:
    - CVE-2018-20303
ghsas:
    - GHSA-9hxg-w7qf-hh93
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2018-20303
    - report: https://github.com/gogs/gogs/issues/5558
    - fix: https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
    - web: https://pentesterlab.com/exercises/cve-2018-18925/
    - advisory: https://github.com/advisories/GHSA-9hxg-w7qf-hh93
@neild neild self-assigned this Jul 31, 2023
@neild neild added the excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. label Jul 31, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

@GoVulnBot GoVulnBot mentioned this issue Nov 15, 2024
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@neild neild

Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot