FreeBSD: VID-25A697DE-BCA1-11EF-8926-9B4F2D14EB53: forgejo -- unauthorized user impersonation

FreeBSD: VID-25A697DE-BCA1-11EF-8926-9B4F2D14EB53: forgejo -- unauthorized user impersonation

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

12/12/2024

Created

12/20/2024

Added

12/19/2024

Modified

12/19/2024

Description

Problem Description:

When Forgejo is configured to run the internal ssh server with

[server].START_SSH_SERVER=true, it was possible for a registered user

to impersonate another user.The rootless container image uses the

internal ssh server by default and was vulnerable.A Forgejo

instance running from a binary or from a root container image does

not use the internal ssh server by default and was not vulnerable.

The incorrect use of the crypto package is the root cause of the

vulnerability and was fixed for the internal ssh server.

Revert "allow synchronizing user status from OAuth2 login

providers"

Solution(s)

• freebsd-upgrade-package-forgejo