CVE-2021-3382: 
NixOS vulnerability analysis and mitigation

A stack buffer overflow vulnerability was identified in Gitea versions 1.9.0 through 1.13.1. The vulnerability, tracked as CVE-2021-3382, was discovered in January 2021 and publicly disclosed on February 5, 2021. The issue stems from the incorrect use of filepath instead of path in the software's routing system (NVD, Ubuntu Security).

The vulnerability occurs due to the improper implementation of file path handling in Gitea's routing system, specifically in the routers/editor component. The issue manifests when filepath is incorrectly used instead of path, which can lead to a stack overflow condition particularly on Windows systems. The vulnerability has been assigned a CVSS 3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu Security, Gitea PR).

When exploited, this vulnerability allows remote attackers to cause a denial of service condition, resulting in a system crash. The impact assessment indicates that while there are no confidentiality or integrity impacts, the availability impact is rated as High (Ubuntu Security).

The vulnerability is exploitable over the network with low attack complexity and requires no privileges or user interaction. The attack vector is related to file path manipulation, which can trigger a stack overflow condition specifically on Windows systems (Gitea PR).

The vulnerability was addressed through a pull request (#14390) that corrected the usage of path instead of filepath in the routers/editor component. The fix was merged into the master branch and backported to affected versions (Gitea PR).