Gogs vulnerable to improper PAM authorization handling
GHSA-gw5h-h6hj-f56g · CVE-2022-0871 · GO-2022-0369
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.
Patches
Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.
Workarounds
In addition to marking PAM accounts as expired, also disable/lock them. Running usermod -L <username> will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login.
References
https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
References
- WEB https://github.com/gogs/gogs/security/advisories/GHSA-gw5h-h6hj-f56g
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-0871
- WEB https://github.com/gogs/gogs/issues/6810
- WEB https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78
- PACKAGE https://github.com/gogs/gogs
- WEB https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62
Ready to move
Start Securing
Free, no credit card | First findings in minutes