Forgejo v16.0.5 released

Forgejo hat v16.05 released. Dieser Release ist ein Security Releases. Also ran und umgehend aktualisieren.

Release notes

• Security bug fixes

  • PR: Critical: fix: prevent ApplyDiffPatch from mutating bare repo config. When a patch is applied to a Forgejo repo through Forgejo's Web UI, Web cherry-pick, or /diffpatch API, a git apply --index command-line is executed to apply the patch to a temporary bare git repository. An unusual behaviour of git apply can cause arbitrary files the working direction to be changed, which is within the bare repository, and that behaviour can be abused by a malicious user to perform unexpected operations on the Forgejo host. This vulnerability allows execution of arbitrary processes on the Forgejo host as a remote code execution attack. The issue has been addressed by ensuring that the working directory is an unrelated temporary directory. This vulnerability is a variation on PR 13705, a vulnerability that was fixed in Forgejo v15.0.6. This variation was not detected at that time.

  • PR: prevent CSRF attacks on OpenID identity associations. When OpenID sign-in is enabled on a Forgejo host, a logged-in user can add an additional OpenID address to their user account in the /user/settings/security page. The HTTP endpoint responsible for registering an OpenID address is an HTTP GET request, as required by the OpenID specification. The endpoint was vulnerable to a CSRF attack where an unexpected GET request generated by a user's browser can register an unexpected OpenID identity on their currently logged-in Forgejo account. The vulnerability has been remediated by validating that a request to add an OpenID identity is initiated by the currently logged-in user.

• Features

  • PR (backported): feat: add support in Forgejo's update checker for LTS and multiple releases

Quelle: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.5.md