git: 36060fbbb19c - main - security/vuxml: Add www/gitea vulnerabilities

From: Florian Smeets <flo_at_FreeBSD.org>
Date: Tue, 29 Mar 2022 21:00:34 UTC
The branch main has been updated by flo:

URL: https://cgit.FreeBSD.org/ports/commit/?id=36060fbbb19c439751045bc139fc15cb4b02a231

commit 36060fbbb19c439751045bc139fc15cb4b02a231
Author:     fsbruva@yahoo.com <fsbruva@yahoo.com>
AuthorDate: 2022-03-29 20:39:43 +0000
Commit:     Florian Smeets <flo@FreeBSD.org>
CommitDate: 2022-03-29 20:59:57 +0000

    security/vuxml: Add www/gitea vulnerabilities
    
    PR:             262898
---
 security/vuxml/vuln-2022.xml | 61 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index 9dfb4792beff..22dcb8a62950 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,64 @@
+  <vuln vid="83466f76-aefe-11ec-b4b6-d05099c0c059">
+    <topic>gitea -- Open Redirect on login</topic>
+    <affects>
+      <package>
+	<name>gitea</name>
+	<range><lt>1.16.5</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Andrew Thornton reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1058">
+	  <p>
+	    When a location containing backslashes is presented, the existing
+	    protections against open redirect are bypassed, because browsers
+	    will convert adjacent forward and backslashes within the location
+	    to double forward slashes.
+	  </p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2022-1058</cvename>
+      <url>https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d/</url>
+    </references>
+    <dates>
+      <discovery>2022-03-23</discovery>
+      <entry>2022-03-29</entry>
+    </dates>
+  </vuln>
+
+  <vuln vid="0ff80f41-aefe-11ec-b4b6-d05099c0c059">
+    <topic>gitea -- Improper/incorrect authorization</topic>
+    <affects>
+      <package>
+	<name>gitea</name>
+	<range><lt>1.16.4</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Youssef Rebahi-Gilbert reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0905">
+	  <p>
+	    When Gitea is built and configured for PAM authentication
+	    it skips checking authorization completely. Therefore expired
+	    accounts and accounts with expired passwords can still login.
+	  </p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2022-0905</cvename>
+      <url>https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb</url>
+    </references>
+    <dates>
+      <discovery>2022-03-06</discovery>
+      <entry>2022-03-29</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="ab2d7f62-af9d-11ec-a0b8-3065ec8fd3ec">
     <topic>chromium -- multiple vulnerabilities</topic>
     <affects>