439
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 11 months ago by to c/selfhosted@lemmy.world
86 comments fedilink hide all child comments
 

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

other discussions
23
700+ self-hosted Git instances battered in 0-day attacks (RCE in Gogs) (www.theregister.com)
submitted 11 months ago by to c/cybersecurity@sh.itjust.works
comment fedilink hide all child comments
 

Symlink bug in Gogs lets attacker commit a repo with a symlink pointing to a system file, and then Gogs will access the file under its own permissions I guess. Not good. Gogs should only run as an untrusted user though anyway.

Article doesn't say whether Gitea or Forgejo (both Gogs descendants) have the same bug.

Gogs, Gitea, and Forgejo are all Git forges (like Gitlab, basically a self-hosted Github-like web app) for those not familiar.