data/reports/GO-2020-0021.yaml

modules:
  - module: github.com/gogits/gogs
    versions:
      - fixed: 0.5.8
    vulnerable_at: 0.5.5
    packages:
      - package: github.com/gogits/gogs
        symbols:
          - GetIssues
          - SearchRepositoryByName
          - SearchUserByName
        skip_fix: 'TODO: Revisit this reason (Some dependencies no longer exist)'
description: |
    Due to improper santization of user input, a number of methods are
    vulnerable to SQL injection if used with user input that has not
    been santized by the caller.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2014-8681
ghsas:
  - GHSA-mr6h-chqp-p9g2
credit: Pascal Turbing and Jiahua (Joe) Chen
references:
  - fix: https://github.com/gogs/gogs/commit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8
  - web: https://seclists.org/fulldisclosure/2014/Nov/31