Medium WID-SEC-2025-1837 2 CVEs

Gitea: Mehrere Schwachstellen

Published Aug 14, 2025 · Updated Nov 27, 2025 · Revision 3 · de-DE

Vendor: RESF Product: Rocky Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um einen nicht näher beschriebenen Angriff durchzuführen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 2

High 7.0

CVE-2025-47907

Incorrect results returned from Rows.Scan in database/sql

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that…

Go standard library database/sql katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Aug 7, 2025
Medium 6.5

CVE-2025-47906

Unexpected paths returned from LookPath in os/exec

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Go standard library os/exec katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 18, 2025

Revision history

2025-11-27 #3
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
2025-09-18 #2
Referenz(en) aufgenommen: EUVD-2025-30195, GO-2025-3956
2025-08-14 #1
Initiale Fassung

References

Gitea 1.24.5 release vom 2025-08-14
https://blog.gitea.com/release-of-1.24.5
Rocky Linux Security Advisory RLSA-2025:22005 vom 2025-11-28
https://errata.build.resf.org/RLSA-2025:22005