|
Lines 1-3
Link Here
|
|
|
1 |
<vuln vid="f07c8f87-8e65-11ef-81b8-659bf0027d16"> |
| 2 |
<topic>forgejo -- multiple vulnerabilities</topic> |
| 3 |
<affects> |
| 4 |
<package> |
| 5 |
<name>forgejo</name> |
| 6 |
<range><lt>9.0.1</lt></range> |
| 7 |
</package> |
| 8 |
<package> |
| 9 |
<name>forgejo7</name> |
| 10 |
<range><lt>7.0.10</lt></range> |
| 11 |
</package> |
| 12 |
</affects> |
| 13 |
<description> |
| 14 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 15 |
<h1>Problem Description:</h1> |
| 16 |
<ul> |
| 17 |
<li>Forgejo generates a token which is used to authenticate web |
| 18 |
endpoints that are only meant to be used internally, for instance |
| 19 |
when the SSH daemon is used to push a commit with Git. The |
| 20 |
verification of this token was not done in constant time and was |
| 21 |
susceptible to timing attacks. A pre-condition for such an attack is |
| 22 |
the precise measurements of the time for each operation. Since it |
| 23 |
requires observing the timing of network operations, the issue is |
| 24 |
mitigated when a Forgejo instance is accessed over the internet |
| 25 |
because the ISP introduce unpredictable random delays.</li> |
| 26 |
<li>Because of a missing permission check, the branch used to propose |
| 27 |
a pull request to a repository can always be deleted by the user |
| 28 |
performing the merge. It was fixed so that such a deletion is only |
| 29 |
allowed if the user performing the merge has write permission to the |
| 30 |
repository from which the pull request was made.</li> |
| 31 |
</ul> |
| 32 |
</body> |
| 33 |
</description> |
| 34 |
<references> |
| 35 |
<url>https://codeberg.org/forgejo/forgejo/milestone/8544</url> |
| 36 |
<url>https://codeberg.org/forgejo/forgejo/pulls/5719</url> |
| 37 |
<url>https://codeberg.org/forgejo/forgejo/pulls/5718</url> |
| 38 |
</references> |
| 39 |
<dates> |
| 40 |
<discovery>2024-10-28</discovery> |
| 41 |
<entry>2024-10-28</entry> |
| 42 |
</dates> |
| 43 |
</vuln> |
| 44 |
|
| 1 |
<vuln vid="fafaef4d-f364-4a07-bbdd-bf53448c593c"> |
45 |
<vuln vid="fafaef4d-f364-4a07-bbdd-bf53448c593c"> |
| 2 |
<topic>chromium -- multiple security fixes</topic> |
46 |
<topic>chromium -- multiple security fixes</topic> |
| 3 |
<affects> |
47 |
<affects> |