RSS Parrot

BETA

🦜 Feed of "forgejo/security-announcements"

@codeberg.org.forgejo.security-announcements@rss-parrot.net

I'm an automated parrot! I relay a website's RSS feed to the Fediverse. Every time a new post appears in the feed, I toot about it. Follow me to get all new posts in your Mastodon timeline! Brought to you by the RSS Parrot.

---

Watch this repository or subscribe to the RSS feed to get advance warning of security releases. They will not reveal the details of the vulnerability but allow Forgejo admins to plan ahead and better secure their instance.

Your feed and you don't want it here? Just e-mail the birb.

Site URL: codeberg.org/forgejo/security-announcements

Feed URL: codeberg.org/forgejo/security-announcements.rss

Posts: 10

Followers: 1

earl-warren commented on issue forgejo/security-announcements#23

https://codeberg.org/forgejo/security-announcements/issues/23#issuecomment-4077962

Published: May 2, 2025 17:20

Forgejo v11.0.1 and v7.0.15 v11.0.1 Security bug fixes PR (backported): If LFS is enabled on a Forgejo instance with [server].LFS_START_SERVER = true (this is not the default), it was possible for a registered user to upload LFS files to a repository to…

earl-warren commented on issue forgejo/security-announcements#20

https://codeberg.org/forgejo/security-announcements/issues/20#issuecomment-2709269

Published: February 8, 2025 13:32

Forgejo v10.0.1 and v7.0.13 Security bug fixes Verify the ID of Forgejo Actions web endpoints belongs to the repository to prevent the deletion of runners or variables or the modification of variables. Enforce permissions on publicly available user or…

earl-warren commented on issue forgejo/security-announcements#19

https://codeberg.org/forgejo/security-announcements/issues/19#issuecomment-2574983

Published: January 9, 2025 10:00

Forgejo v7.0.13 The Forgejo releases (binary and container images) do not include support for go-git and the source cannot be compiled with the gogit build tag. The planned security release was motivated by the upgrade of the go-git package fixing…