CVE-2024-39930: github.com/gogs/gogs affected by CVE-2024-39930

July 4, 2024 (updated July 10, 2024)

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious –split-string env request if the built-in SSH server is activated. Windows installations are unaffected.

References

github.com/advisories/GHSA-p69r-v3h4-rj4f
github.com/gogs/gogs
github.com/gogs/gogs/releases
nvd.nist.gov/vuln/detail/CVE-2024-39930
www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1

Code Behaviors & Features

Detect and mitigate CVE-2024-39930 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →