{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Gitea ist ein quelloffener Github-Klon.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1167 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1167.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1167 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1167"
      },
      {
        "category": "external",
        "summary": "Gitea Release 1.19.3 vom 2023-05-08",
        "url": "https://blog.gitea.io/2023/05/gitea-1.19.3-is-released/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3318 vom 2023-05-25",
        "url": "https://access.redhat.com/errata/RHSA-2023:3318"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-3318 vom 2023-05-25",
        "url": "https://linux.oracle.com/errata/ELSA-2023-3318.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3319 vom 2023-05-25",
        "url": "https://access.redhat.com/errata/RHSA-2023:3319"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3323 vom 2023-05-25",
        "url": "https://access.redhat.com/errata/RHSA-2023:3323"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-3319 vom 2023-05-26",
        "url": "http://linux.oracle.com/errata/ELSA-2023-3319.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2023-EFD9BBF67E vom 2023-05-26",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-efd9bbf67e"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3415 vom 2023-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2023:3415"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3379 vom 2023-06-03",
        "url": "https://access.redhat.com/errata/RHSA-2023:3379"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3435 vom 2023-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2023:3435"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-2052 vom 2023-06-05",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2052.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3445 vom 2023-06-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:3445"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6140-1 vom 2023-06-06",
        "url": "https://ubuntu.com/security/notices/USN-6140-1"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1760 vom 2023-06-09",
        "url": "https://alas.aws.amazon.com/ALAS-2023-1760.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7001859 vom 2023-06-07",
        "url": "https://www.ibm.com/support/pages/node/7001859"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3644 vom 2023-06-16",
        "url": "https://access.redhat.com/errata/RHSA-2023:3644"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2023-06-29",
        "url": "https://access.redhat.com/errata/RHSA-2023:3918"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3905 vom 2023-06-28",
        "url": "https://access.redhat.com/errata/RHSA-2023:3905"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Bulletin HCSEC-2023-19 vom 2023-06-29",
        "url": "https://discuss.hashicorp.com/t/hcsec-2023-19-terraform-enterprise-docker-engine-and-go-s-cve-2023-24540/55536"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7008449 vom 2023-06-29",
        "url": "https://www.ibm.com/support/pages/node/7008449"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-2163 vom 2023-07-26",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2163.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7011697 vom 2023-08-03",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2023080304"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4470 vom 2023-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2023:4470"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4335 vom 2023-08-08",
        "url": "https://access.redhat.com/errata/RHSA-2023:4335"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4627 vom 2023-08-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:4627"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASGOLANG1.19-2023-001 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASGOLANG1.19-2023-001.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5421 vom 2023-10-03",
        "url": "https://access.redhat.com/errata/RHSA-2023:5421"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5442 vom 2023-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2023:5442"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5947 vom 2023-10-26",
        "url": "https://access.redhat.com/errata/RHSA-2023:5947"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6402 vom 2023-11-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:6402"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6473 vom 2023-11-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:6473"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6346 vom 2023-11-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:6346"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6474 vom 2023-11-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:6474"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6363 vom 2023-11-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:6363"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7069319 vom 2023-11-08",
        "url": "https://www.ibm.com/support/pages/node/7069319"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6832 vom 2023-11-09",
        "url": "https://access.redhat.com/errata/RHSA-2023:6832"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6938 vom 2023-11-15",
        "url": "https://access.redhat.com/errata/RHSA-2023:6938"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6939 vom 2023-11-15",
        "url": "https://access.redhat.com/errata/RHSA-2023:6939"
      },
      {
        "category": "external",
        "summary": "WIBU Security Advisory WIBU-231024-01 vom 2024-01-22",
        "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-231024-01.pdf"
      }
    ],
    "source_lang": "en-US",
    "title": "Gitea: Mehrere Schwachstellen erm\u00f6glichen nicht spezifizierten Angriff",
    "tracking": {
      "current_release_date": "2024-01-22T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:27:01.098+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-1167",
      "initial_release_date": "2023-05-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-05-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-05-24T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-25T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2023-05-29T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2023-05-31T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-04T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-05T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat und Amazon aufgenommen"
        },
        {
          "date": "2023-06-08T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon und IBM aufgenommen"
        },
        {
          "date": "2023-06-15T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-28T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat und Hashicorp aufgenommen"
        },
        {
          "date": "2023-06-29T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-25T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-08-02T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-08-03T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-13T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-27T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-10-04T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-10-26T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-11-07T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-11-08T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2023-11-14T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-01-22T23:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von WIBU-SYSTEMS aufgenommen"
        }
      ],
      "status": "final",
      "version": "24"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hashicorp Terraform \u003c 202303-1",
            "product": {
              "name": "Hashicorp Terraform \u003c 202303-1",
              "product_id": "T028341",
              "product_identification_helper": {
                "cpe": "cpe:/a:hashicorp:terraform:202303-1"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hashicorp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM DB2",
            "product": {
              "name": "IBM DB2",
              "product_id": "5104",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:db2:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM Spectrum Protect plus \u003c 10.1.12.6",
                "product": {
                  "name": "IBM Spectrum Protect plus \u003c 10.1.12.6",
                  "product_id": "T029070",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus__10.1.12.6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Spectrum Protect \u003c plus 10.1.15.3",
                "product": {
                  "name": "IBM Spectrum Protect \u003c plus 10.1.15.3",
                  "product_id": "T031010",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus_10.1.15.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source Gitea \u003c 1.19.3",
            "product": {
              "name": "Open Source Gitea \u003c 1.19.3",
              "product_id": "T027650",
              "product_identification_helper": {
                "cpe": "cpe:/a:gitea:gitea:1.19.3"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4",
                "product": {
                  "name": "Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4",
                  "product_id": "T027916",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "category": "product_name",
            "name": "Red Hat OpenShift",
            "product": {
              "name": "Red Hat OpenShift",
              "product_id": "T008027",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Wibu-Systems CodeMeter Runtime \u003c 7.60d",
            "product": {
              "name": "Wibu-Systems CodeMeter Runtime \u003c 7.60d",
              "product_id": "T032271",
              "product_identification_helper": {
                "cpe": "cpe:/a:wibu:codemeter:runtime__7.60d"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Wibu-Systems"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29400",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Gitea bez\u00fcglich der genutzten Komponente \"golang\", die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028341",
          "T008027",
          "T027916",
          "67646",
          "T000126",
          "5104",
          "T029070",
          "398363",
          "T032271",
          "T004914",
          "T031010",
          "74185"
        ]
      },
      "release_date": "2023-05-08T22:00:00Z",
      "title": "CVE-2023-29400"
    },
    {
      "cve": "CVE-2023-24540",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Gitea bez\u00fcglich der genutzten Komponente \"golang\", die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028341",
          "T008027",
          "T027916",
          "67646",
          "T000126",
          "5104",
          "T029070",
          "398363",
          "T032271",
          "T004914",
          "T031010",
          "74185"
        ]
      },
      "release_date": "2023-05-08T22:00:00Z",
      "title": "CVE-2023-24540"
    },
    {
      "cve": "CVE-2023-24539",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Gitea bez\u00fcglich der genutzten Komponente \"golang\", die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028341",
          "T008027",
          "T027916",
          "67646",
          "T000126",
          "5104",
          "T029070",
          "398363",
          "T032271",
          "T004914",
          "T031010",
          "74185"
        ]
      },
      "release_date": "2023-05-08T22:00:00Z",
      "title": "CVE-2023-24539"
    }
  ]
}