ALT-PU-2026-14138: package gitea update to version 1.27.2-alt1
Описание
This update upgrades gitea to version 1.27.2-alt1.
Устраненные уязвимости123
Ссылки59
GHSA-25gq-j9jx-43pg
https://github.com/advisories/GHSA-25gq-j9jx-43pgGHSA-2fcr-jfvc-vgg2
https://github.com/advisories/GHSA-2fcr-jfvc-vgg2GHSA-2m9v-5q2g-58vq
https://github.com/advisories/GHSA-2m9v-5q2g-58vqGHSA-2r5c-gw76-rh3w
https://github.com/advisories/GHSA-2r5c-gw76-rh3wGHSA-2wm4-vwp6-v7xc
https://github.com/advisories/GHSA-2wm4-vwp6-v7xcGHSA-3pww-vcvm-3gmj
https://github.com/advisories/GHSA-3pww-vcvm-3gmjGHSA-3r5c-2xxx-h872
https://github.com/advisories/GHSA-3r5c-2xxx-h872GHSA-44qc-pgvp-wx7v
https://github.com/advisories/GHSA-44qc-pgvp-wx7vGHSA-4xjf-493q-98p3
https://github.com/advisories/GHSA-4xjf-493q-98p3GHSA-5ggr-2f2h-jmvm
https://github.com/advisories/GHSA-5ggr-2f2h-jmvmGHSA-649p-mmhf-85c7
https://github.com/advisories/GHSA-649p-mmhf-85c7GHSA-66m4-5jjr-2rg5
https://github.com/advisories/GHSA-66m4-5jjr-2rg5GHSA-683j-3ff6-hh2x
https://github.com/advisories/GHSA-683j-3ff6-hh2xGHSA-6c6r-5xr4-cr5m
https://github.com/advisories/GHSA-6c6r-5xr4-cr5mGHSA-6cqf-375w-639g
https://github.com/advisories/GHSA-6cqf-375w-639gGHSA-6hm7-3pwj-22rm
https://github.com/advisories/GHSA-6hm7-3pwj-22rmGHSA-777r-4v59-6486
https://github.com/advisories/GHSA-777r-4v59-6486GHSA-7p4h-3gxq-x3h3
https://github.com/advisories/GHSA-7p4h-3gxq-x3h3GHSA-7wvc-rvp7-w99x
https://github.com/advisories/GHSA-7wvc-rvp7-w99xGHSA-82f7-87hm-852x
https://github.com/advisories/GHSA-82f7-87hm-852xGHSA-8p9h-49rc-qgxj
https://github.com/advisories/GHSA-8p9h-49rc-qgxjGHSA-94v3-77j7-vm48
https://github.com/advisories/GHSA-94v3-77j7-vm48GHSA-9mq6-mqjj-c2c5
https://github.com/advisories/GHSA-9mq6-mqjj-c2c5GHSA-cp3q-vrj2-ghhh
https://github.com/advisories/GHSA-cp3q-vrj2-ghhhGHSA-f75j-4cw6-rmx4
https://github.com/advisories/GHSA-f75j-4cw6-rmx4GHSA-fj8v-hjwv-qm88
https://github.com/advisories/GHSA-fj8v-hjwv-qm88GHSA-fq2p-5p22-8g6j
https://github.com/advisories/GHSA-fq2p-5p22-8g6jGHSA-frpw-3h2q-4jj6
https://github.com/advisories/GHSA-frpw-3h2q-4jj6GHSA-fw57-jgch-pgf3
https://github.com/advisories/GHSA-fw57-jgch-pgf3GHSA-g9g6-qhrc-p3qc
https://github.com/advisories/GHSA-g9g6-qhrc-p3qcGHSA-gx3v-q759-g323
https://github.com/advisories/GHSA-gx3v-q759-g323GHSA-h2x6-g7q6-344v
https://github.com/advisories/GHSA-h2x6-g7q6-344vGHSA-h56g-4qw7-2mxg
https://github.com/advisories/GHSA-h56g-4qw7-2mxgGHSA-j2w3-9c3r-g83q
https://github.com/advisories/GHSA-j2w3-9c3r-g83qGHSA-jr5x-6h83-wrxf
https://github.com/advisories/GHSA-jr5x-6h83-wrxfGHSA-m932-crvm-gcp5
https://github.com/advisories/GHSA-m932-crvm-gcp5GHSA-mg4f-x9v4-6h2p
https://github.com/advisories/GHSA-mg4f-x9v4-6h2pGHSA-p4mj-98mv-xq26
https://github.com/advisories/GHSA-p4mj-98mv-xq26GHSA-pgqf-926r-548m
https://github.com/advisories/GHSA-pgqf-926r-548mGHSA-prr9-9mp4-5gp2
https://github.com/advisories/GHSA-prr9-9mp4-5gp2GHSA-q423-49rw-g9mh
https://github.com/advisories/GHSA-q423-49rw-g9mhGHSA-q9pg-jj6x-j9p6
https://github.com/advisories/GHSA-q9pg-jj6x-j9p6GHSA-qf2f-qh6p-7v89
https://github.com/advisories/GHSA-qf2f-qh6p-7v89GHSA-rcr6-4jqh-j84m
https://github.com/advisories/GHSA-rcr6-4jqh-j84mGHSA-rgv6-xp99-6mgj
https://github.com/advisories/GHSA-rgv6-xp99-6mgjGHSA-rh79-75qm-gwjr
https://github.com/advisories/GHSA-rh79-75qm-gwjrGHSA-rqhx-647v-wx32
https://github.com/advisories/GHSA-rqhx-647v-wx32GHSA-v73x-hx65-6pf4
https://github.com/advisories/GHSA-v73x-hx65-6pf4GHSA-v96j-25gv-g2w9
https://github.com/advisories/GHSA-v96j-25gv-g2w9GHSA-vrhc-jjfc-m3m3
https://github.com/advisories/GHSA-vrhc-jjfc-m3m3GHSA-vxv2-8j6r-pcpg
https://github.com/advisories/GHSA-vxv2-8j6r-pcpgGHSA-w5pg-649r-p6gg
https://github.com/advisories/GHSA-w5pg-649r-p6ggGHSA-wrf9-r3h7-7x5v
https://github.com/advisories/GHSA-wrf9-r3h7-7x5vGHSA-wwqq-x6w4-frm2
https://github.com/advisories/GHSA-wwqq-x6w4-frm2GHSA-x77v-q46j-393g
https://github.com/advisories/GHSA-x77v-q46j-393gGHSA-xmj7-xj85-hfc3
https://github.com/advisories/GHSA-xmj7-xj85-hfc3GHSA-xv9x-fj9g-vj6h
https://github.com/advisories/GHSA-xv9x-fj9g-vj6hGHSA-xxjv-752h-3vp2
https://github.com/advisories/GHSA-xxjv-752h-3vp2Связанные уязвимости
ALT-PU-2026-16069: package `gitea` update to version 1.27.3-alt1
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforce ...
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.