No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

There's a huge hole and no one is patching it thus far. A critical, remote code execution (RCE) bug in Gogs, a popular open-source self-hosted Git service, can be exploited by any authenticated user - no special privileges required - on a default installation to fully compromise vulnerable servers, steal credentials and multi- …

[ecofeco]

The fun never stops!

The current state of IT is not going to end well.

[amanfromMars 1]

Re: The fun never stops ..... and aint that the gospel truth!

The current state of IT is not going to end well....... ecofeco

Amen to that, ecofeco. Do you care/dare to share that and those so deservedly worthy of such as is sure to be a serially untidy and guaranteed popularly supported and painful and devastatingly expensive end?

New World Orders aren’t deeds done dirt cheap ...... and that’s where y’all is at ..... and what AI and IT are at.

I Kid U Not ‽

[elsergiovolador]

Re: The fun never stops!

When developers are treated as pariahs and cost items in the spreadsheet, why should they care about shareholders milking them dry?

Despite earning well comparably to street sweepers or teachers, developers get tiny fraction of the value they generate.

I think developers should care even less and produce output adequate to pay they receive.

[Jason Bloomberg]

Silence is golden?

When will people understand that what most infuriates people is not being told what the situation is, followed by not knowing what is being done, and when it will be resolved?

Two months of going off-grid isn't helpful to anyone, not even Cogs.

I know it's tough, I've had my share of cock-ups, have had to pull product and tell customers to stop using it, could offer nothing more at that time than "We are looking into it. Frantically looking into it".

When you screw up you have to own it, have to be seen owning it if you expect to have any customers left when things do get resolved.

[Paul Crawford]

Re: Silence is golden?

But it was written in go which is a memory safe language. What can possibly go wrong?

[stiine]

Re: Silence is golden?

Everything?

[Mishak]

As we all know

Memory safe != secure

[Paul Crawford]

Re: As we all know

Clearly I should have used the sarcasm tag.

[Anonymous Coward]

Finally, a but which has reached publication date without a patch, but the publication comes with mitigation steps.

[Anonymous Coward]

What about Gitea?

Is that affected as well, or have the code bases diverged along this path?