724364 – (CVE-2020-13246) <www-apps/gitea-1.11.6: Denial of service via repo organisation transfer (CVE-2020-13246)

Bug 724364 (CVE-2020-13246) - <www-apps/gitea-1.11.6: Denial of service via repo organisation transfer (CVE-2020-13246)

Summary: <www-apps/gitea-1.11.6: Denial of service via repo organisation transfer (CVE...

Status:	RESOLVED FIXED

Alias:	CVE-2020-13246

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	https://github.com/go-gitea/gitea/iss...
Whiteboard:	~3 [noglsa cve]
Keywords:

Depends on:
Blocks:

Reported:	2020-05-20 19:55 UTC by Sam James
Modified:	2020-06-04 13:56 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-05-20 19:55:14 UTC

Description:
"An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another."

Comment 1 Sam James archtester

2020-05-20 19:55:41 UTC

Patch: https://github.com/go-gitea/gitea/pull/11438

@maintainer(s), please apply provided patch if it seems appropriate.

Comment 2 Nils Freydank 2020-05-31 12:10:00 UTC

Upstream released version 1.11.6[1]:

"SECURITY

    Fix missing authorization check on pull for public repos of private/limited org (#11656) (#11683)
    Use session for retrieving org teams (#11438) (#11439)
"

[1] https://github.com/go-gitea/gitea/releases/tag/v1.11.6

My locally bumped ebuild from the main tree works fine on my host.

Comment 3 Sam James archtester

2020-06-04 13:56:31 UTC

Thanks.

Remember to include Bug: tags in commits so we can see when things get fixed.