BSD Portsgogs -- Multiple vulnerabilities
· CVE-2024-44625, CVE-2024-39933, CVE-2024-39932, CVE-2024-39931, CVE-2024-39930 · VuXML entry
[email protected] reports: CVE-2024-44625: Directory Traversal via the editFilePost function of internal/route/repo/editor.go. CVE-2024-39933: Gogs allows argument injection during the tagging of a new release. CVE-2024-39932: Gogs allows argument injection during the previewing of changes. CVE-2024-39931: Gogs allows deletion of internal files. CVE-2024-39930: The built-in SSH server of Gogs allows argument injection …
Affected versions
- gogs < 0.13.0
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | devel/gogs | 0.14.3_6 | fixed |