x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-px5r-fqj6-r2f8

[GoVulnBot]

In GitHub Security Advisory GHSA-px5r-fqj6-r2f8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
gogs.io/gogs		<= 0.11.53

Cross references:

• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-gw5h-h6hj-f56g #369 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-q347-cg56-pcq4 #377 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-pj96-4jhv-v792 #473 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-5gjh-5j4f-cpwv #554 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-67mx-jc2f-jgjm #556 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-6vcc-v9vw-g2x5 #562 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-7v5r-r995-q2x2 #566 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-994f-7g86-qr56 #570 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-w689-557m-2cvq #583 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-ff28-f46g-r9g8 #597 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-9hx4-qm7h-x84j #642 EFFECTIVELY_PRIVATE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-958j-443g-7mm7 #749 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-4c7m-vv47-7c69 #788 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-5r2v-6gm6-vpvh #797 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-cpgw-2wxr-pww3 #822 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-g6xv-8q23-w2q3 #831 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-mcjj-2fvq-mc3r #1060 NOT_IMPORTABLE
• Module gogs.io/gogs appears in issue x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-pfvh-p8qp-9ww9 #1596 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: gogs.io/gogs
      versions:
        - {}
      vulnerable_at: 0.13.0
      packages:
        - package: gogs.io/gogs
summary: Gogs XSS Vulnerability
description: |-
    In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type
    sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an
    "X-Content-Type-Options: nosniff" header is not sent.
cves:
    - CVE-2018-17031
ghsas:
    - GHSA-px5r-fqj6-r2f8
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2018-17031
    - report: https://github.com/gogs/gogs/issues/5397
    - advisory: https://github.com/advisories/GHSA-px5r-fqj6-r2f8

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)