Gitea Debian Package Registry Parser Vulnerability Under Investigation
An early warning has been issued regarding potential vulnerabilities in Gitea's Debian package registry parser that could lead to CPU and memory exhaustion, resulting in a denial of service. Software engineers using Gitea are advised to assess their exposure.
What happened
Reportedly, the Debian package registry parser in Gitea contains vulnerabilities that can cause CPU and memory exhaustion through unbounded decompression and O(N^2) string concatenation. An attacker may be able to trigger a denial of service by uploading a malicious .deb file. The affected component is gitea (go), introduced in version 0 and fixed in version 1.27.0.
To assess your exposure, check if your Gitea instance is running a version prior to 1.27.0. It is recommended to upgrade to the latest version of Gitea once a patch is available. For more detailed information, consult the primary sources listed below.
Primary sources for this early warning include multiple GitHub Security Advisories detailing various vulnerabilities in Gitea, such as incomplete SSRF protection, default configurations allowing user impersonation, and HMAC ambiguities in Gitea Actions Artifacts. These sources should be consulted for a comprehensive understanding of the potential risks and mitigations.
How 0Day mitigates this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.