Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-29134 #353

Closed
GoVulnBot opened this issue Mar 15, 2022 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-29134 #353

GoVulnBot opened this issue Mar 15, 2022 · 2 comments
Assignees
@julieqiu
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In CVE-2021-29134, the reference URL github.com/go-gitea/gitea (and possibly others) refers to something in Go.

module: github.com/go-gitea/gitea
package: n/a
description: |
    The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
cves:
  - CVE-2021-29134
links:
    pr: https://github.com/go-gitea/gitea/pull/15125/files
    context:
      - https://github.com/go-gitea/gitea/releases
      - https://github.com/go-gitea/gitea/releases/tag/v1.13.6

See doc/triage.md for instructions on how to triage this report.
@julieqiu julieqiu self-assigned this Mar 17, 2022
@julieqiu julieqiu mentioned this issue Mar 25, 2022
Open
@neild neild added excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. and removed NotGoVuln labels Aug 10, 2022
@GoVulnBot GoVulnBot mentioned this issue Aug 7, 2023
Closed
This was referenced Nov 8, 2023
Closed
Closed
Closed
Closed
Closed
This was referenced Apr 24, 2024
Closed
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592767 mentions this issue: data/reports: unexclude 50 reports

@GoVulnBot GoVulnBot mentioned this issue Aug 6, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607216 mentions this issue: data/reports: unexclude 20 reports (14)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (14)
b61874e 
  - data/reports/GO-2022-0314.yaml
  - data/reports/GO-2022-0315.yaml
  - data/reports/GO-2022-0325.yaml
  - data/reports/GO-2022-0328.yaml
  - data/reports/GO-2022-0329.yaml
  - data/reports/GO-2022-0339.yaml
  - data/reports/GO-2022-0340.yaml
  - data/reports/GO-2022-0342.yaml
  - data/reports/GO-2022-0344.yaml
  - data/reports/GO-2022-0348.yaml
  - data/reports/GO-2022-0350.yaml
  - data/reports/GO-2022-0351.yaml
  - data/reports/GO-2022-0353.yaml
  - data/reports/GO-2022-0354.yaml
  - data/reports/GO-2022-0357.yaml
  - data/reports/GO-2022-0358.yaml
  - data/reports/GO-2022-0359.yaml
  - data/reports/GO-2022-0360.yaml
  - data/reports/GO-2022-0363.yaml
  - data/reports/GO-2022-0365.yaml

Updates #314
Updates #315
Updates #325
Updates #328
Updates #329
Updates #339
Updates #340
Updates #342
Updates #344
Updates #348
Updates #350
Updates #351
Updates #353
Updates #354
Updates #357
Updates #358
Updates #359
Updates #360
Updates #363
Updates #365

Change-Id: I88cff49c8c254ce8df68a3fb336657e69cb8ed58
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607216
Commit-Queue: Tatiana Bradley <tatianabradley@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@julieqiu julieqiu

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@neild @julieqiu @gopherbot @GoVulnBot