x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2020-14144

[tatianab]

CVE-2020-14144 references github.com/go-gitea/gitea, which may be a Go module.

Description:
** DISPUTED ** The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-14144
• web: https://github.com/go-gitea/gitea/releases
• web: https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
• fix: Mitigate Security vulnerability in the git hook feature go-gitea/gitea#13058
• web: https://docs.gitlab.com/ee/administration/server_hooks.html
• web: https://docs.github.com/en/enterprise-server@2.19/admin/policies/creating-a-pre-receive-hook-script
• web: http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html
• web: https://github.com/PandatiX/CVE-2021-28378
• web: https://github.com/PandatiX/CVE-2021-28378#notes
• Imported by: https://pkg.go.dev/github.com/go-gitea/gitea?tab=importedby

Cross references:

• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45325 #308 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45326 #309 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45327 #310 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45329 #314 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45331 #315 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-29134 #353 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-27313 #442 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-30781 #450 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: GHSA-36h2-95gj-w488 #579 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea/models: GHSA-f5fj-7265-jxhj #823 NOT_IMPORTABLE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: GHSA-g2qx-6ghw-67hm #830 NOT_IMPORTABLE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea/models: GHSA-hpmr-prr2-cqc4 #846 NOT_IMPORTABLE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea/models: GHSA-q47x-6mqq-4w92 #862 NOT_IMPORTABLE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-42968 #1065 EFFECTIVELY_PRIVATE
• Module github.com/go-gitea/gitea appears in issue x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-38795 #1999 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/go-gitea/gitea
      vulnerable_at: 1.20.5
      packages:
        - package: n/a
cves:
    - CVE-2020-14144
references:
    - web: https://github.com/go-gitea/gitea/releases
    - web: https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
    - fix: https://github.com/go-gitea/gitea/pull/13058
    - web: https://docs.gitlab.com/ee/administration/server_hooks.html
    - web: https://docs.github.com/en/enterprise-server@2.19/admin/policies/creating-a-pre-receive-hook-script
    - web: http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html
    - web: https://github.com/PandatiX/CVE-2021-28378
    - web: https://github.com/PandatiX/CVE-2021-28378#notes

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports