CVE-2020-28991

Name of the Vulnerable Software and Affected Versions Gitea versions 0.9.99 through 1.12.x before 1.12.6

Description The issue arises from the failure to prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo form.go. This allows for potential exploitation.

Recommendations For Gitea versions 0.9.99 through 1.12.x before 1.12.6, update to version 1.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ParseRemoteAddr function in modules/auth/repo form.go until a patch is available.