Gitea 28.3 fixes 20 security vulnerabilities, including an OAuth2 account takeover flaw and workflow permission issues in Actions.
Learn what changed in this maintenance release.
Several of the issues resolved relate to the control of digital access keys. In some cases, keys with limited capabilities could grant access to private code files or perform actions beyond their limits.
Serious issues fixed
One of the most important fixes concerns installations where users could be automatically logged in via external services. Under certain conditions, there was a risk that someone could gain control of existing accounts.
Another issue involved automated processes that were triggered when checking for code changes. Users with read-only permissions could execute processes without authorization, gaining access to hidden storage secrets and elevated keys.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Serious security flaw in Canonical's LXD and MicroCloud allows unauthorized login
↗
The new update also closes loopholes that allowed access to private storage spaces, disclosure of private topics and change requests, as well as issues with special registration keys and data storage.
Speed and improvements
In addition to security issues, the new version brings significant speed improvements. Dashboards and change request lists now load faster, while editing change status has become more efficient.
At the same time, corrections were made to the management of storage spaces so that contribution statistics do not get stuck during their creation and file comparisons are displayed correctly when a file has been renamed.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
