diff options
| author | Stefan Bethke <stb@lassitu.de> | 2023-07-23 10:53:25 +0000 |
|---|---|---|
| committer | Nuno Teixeira <eduardo@FreeBSD.org> | 2023-07-23 11:45:32 +0000 |
| commit | 91fd6b55ab1861914c8a7b0c00e26dbc2932aa68 (patch) | |
| tree | 29cbb373b330b0c5bbcd0dc79abbd2c369f219ad /security/vuxml/vuln/2023.xml | |
| parent | 42d5d340adce5e1ceee1ab34657b342427e38867 (diff) | |
| download | ports-91fd6b55ab1861914c8a7b0c00e26dbc2932aa68.tar.gz ports-91fd6b55ab1861914c8a7b0c00e26dbc2932aa68.zip | |
security/vuxml: Document www/gitea vulnerability
PR: 272672
Security: ab0bab3c-2927-11ee-8608-07b8d3947721
Diffstat (limited to 'security/vuxml/vuln/2023.xml')
| -rw-r--r-- | security/vuxml/vuln/2023.xml | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 38c2114a663a..2ea5519ff417 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,30 @@ + <vuln vid="ab0bab3c-2927-11ee-8608-07b8d3947721"> + <topic>gitea -- Disallow dangerous URL schemes</topic> + <affects> + <package> + <name>gitea</name> + <range><lt>1.20.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Gitea team reports:</p> + <blockquote cite="https://github.com/go-gitea/gitea/pull/25960"> + <p>Disallow javascript, vbscript and data (data uri images still + work) url schemes even if all other schemes are allowed</p> + </blockquote> + </body> + </description> + <references> + <url>https://blog.gitea.com/release-of-1.20.1</url> + <url>https://github.com/go-gitea/gitea/releases/tag/v1.20.1</url> + </references> + <dates> + <discovery>2023-06-18</discovery> + <entry>2023-07-23</entry> + </dates> + </vuln> + <vuln vid="887eb570-27d3-11ee-adba-c80aa9043978"> <topic>OpenSSH -- remote code execution via a forwarded agent socket</topic> <affects> |