GHSA-65f3-3278-7m65

    Dashboard / Vulnerabilities / GHSA-65f3-3278-7m65

    GHSA-65f3-3278-7m65

    Published: 12 Mar 2022Last Modified: 30 Jun 2023

    Summary: Duplicate Advisory: Improper Authorization in Gogs

    Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references. ## Original Description ### Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. ### Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. ### Workarounds In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. ### References https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/ ### For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-0871, https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78, https://github.com/gogs/gogs, https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62

    Affected packages

    Package

    Name: gogs.io/gogs

    Purl: pkg:golang/gogs.io/gogs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.12.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-65f3-3278-7m65 | CVE-DB