Bug 297194 - update www/gitea to 1.27.1 to fix security issues
Summary: update www/gitea to 1.27.1 to fix security issues
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Jochen Neumeister
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-31 11:49 UTC by FiLiS
Modified: 2026-08-16 18:38 UTC (History)
5 users (show)

See Also:
bugzilla: maintainer-feedback? (ports)


Attachments
patch to update www/gitea port to 1.27.1 (911 bytes, patch)
2026-07-31 11:49 UTC, FiLiS
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description FiLiS freebsd_committer freebsd_triage 2026-07-31 11:49:20 UTC
Created attachment 273344 [details]
patch to update www/gitea port to 1.27.1

1.27.1 fixes these issues:

CVE-2026-59774: Unauthenticated arbitrary file read via the Org-mode #+INCLUDE directive. Fixed by #38642 / #38645. Thanks to @xbow-security and, independently, @NightRang3r for reporting the issue, and to @wxiaoguang and @TheFox0x7 for the patch.
CVE-2026-60004: Remote code execution via the diffpatch API through Git hook installation. Fixed by #38637 / #38638. Thanks to @NightRang3r for reporting the issue, and to @wxiaoguang for the patch.

in addition to the issues fixed in 1.27.0, see https://blog.gitea.com/release-of-1.27.0/ 

builds fine on 14.4, 15.0 and 15.1 (all amd64) here.
Comment 1 Mamadou Babaei 2026-08-06 00:22:37 UTC
Any update on this?

The last version in ports is v1.26.4, which is severly vulnerable.

v1.27.0 has address 45 CVEs and v1.27.1 another 2:

https://blog.gitea.com/release-of-1.27.0/

https://blog.gitea.com/release-of-1.27.1/

I've also used the same patch and it builds and runs fine for me.
Comment 2 Jordan Ostreff 2026-08-14 15:17:01 UTC
(In reply to Mamadou Babaei from comment #1)
https://github.com/go-gitea/gitea/releases/tag/v1.27.2

new version, with another portion of bug fixes. Have modified my build tree, it works without issues also ( tested with go 1.26.6 ).
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-08-16 18:32:20 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=c81002f9d9b6dba0aaef25ebf36a8d1b801252df

commit c81002f9d9b6dba0aaef25ebf36a8d1b801252df
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-08-16 18:30:26 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-08-16 18:31:22 +0000

    www/gitea: Update to 1.27.2

    Changelog:      https://blog.gitea.com/release-of-1.27.0/
                    https://blog.gitea.com/release-of-1.27.1/
                    https://github.com/go-gitea/gitea/releases/tag/v1.27.2
    Security:       2f3568eb-999e-11f1-a655-3497f65b111b
    Security:       f4af92f7-95ae-11f1-a6f7-b42e991fc52e
    PR:             297194
    Reported by:    FiLiS
    Approved by:    maintainer timeout (ports@foss-daily.org)
    Sponsored by:   Netzkommune GmbH

 www/gitea/Makefile | 3 +--
 www/gitea/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-08-16 18:37:22 UTC
A commit in branch 2026Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ddef84a05ac70ffe5bd15b756fc5ba30091bb7af

commit ddef84a05ac70ffe5bd15b756fc5ba30091bb7af
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-08-16 18:30:26 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-08-16 18:36:19 +0000

    www/gitea: Update to 1.27.2

    Changelog:      https://blog.gitea.com/release-of-1.27.0/
                    https://blog.gitea.com/release-of-1.27.1/
                    https://github.com/go-gitea/gitea/releases/tag/v1.27.2
    Security:       2f3568eb-999e-11f1-a655-3497f65b111b
    Security:       f4af92f7-95ae-11f1-a6f7-b42e991fc52e
    PR:             297194
    Reported by:    FiLiS
    Approved by:    maintainer timeout (ports@foss-daily.org)
    Sponsored by:   Netzkommune GmbH

    (cherry picked from commit c81002f9d9b6dba0aaef25ebf36a8d1b801252df)

 www/gitea/Makefile | 3 +--
 www/gitea/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)