CVE-2022-0871: Gogs Improper PAM Authorization Handling
Summary
CVE-2022-0871: Gogs vulnerable to improper PAM authorization handling. Affects gogs.io/gogs versions < 0.12.5. Fixed in 0.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing Git repositories. Gogs utilizes PAM (Pluggable Authentication Modules) as an authentication source, allowing users to authenticate using various methods such as local accounts, LDAP, or Active Directory. However, a vulnerability has been discovered in Gogs that affects installations using PAM as an authentication source.
Vulnerability Detail
The vulnerability in Gogs allows expired PAM accounts and accounts with expired passwords to be seen as valid. This means that even if an account's password has expired or the account itself has expired, Gogs will still consider it as a valid account. This can lead to unauthorized access and potential security breaches. The vulnerability has a CVSS score of 8.2, indicating a high severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.5
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
In addition to upgrading, users can also apply a workaround by disabling or locking the affected PAM accounts. This can be done by running the command 'usermod -L <username>'. This command adds an exclamation mark to the password hash of the account, resulting in incorrect password responses when attempting to log in. This effectively prevents unauthorized access through the affected accounts.
Conclusion
The vulnerability in Gogs that allows improper handling of PAM authorization can lead to unauthorized access and security breaches. Users are advised to upgrade to Gogs version 0.12.5 or the latest 0.13.0+dev to fix the vulnerability. Additionally, applying the workaround of disabling or locking affected PAM accounts can provide an extra layer of protection. Regularly reviewing and updating authentication and security configurations is also recommended. For more information and support, please refer to the provided resources.
See every vulnerability recorded for gogs.io/gogs →
FAQ
The vulnerability allows expired PAM accounts and accounts with expired passwords to be considered as valid, potentially leading to unauthorized access and security breaches.
The vulnerability affects Gogs versions prior to 0.12.5. Users should upgrade to this version or the latest 0.13.0+dev to mitigate the issue.
You can use Vulert's playground at Vulert Scanner to check if your Gogs installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
In addition to upgrading and applying the workaround, it is recommended to regularly review and update your authentication and security configurations. This includes enforcing strong passwords, enabling multi-factor authentication, and monitoring user accounts for any suspicious activity.
For more information, you can visit the GitHub advisory page at https://github.com/gogs/gogs/issues/6810. You can also reach out to the Vulert team at info@devnack.com for further support on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
