CVE-2022-1058: 
NixOS vulnerability analysis and mitigation

CVE-2022-1058 is an Open Redirect vulnerability discovered in GitHub repository go-gitea/gitea affecting versions prior to 1.16.5. The vulnerability was disclosed on March 24, 2022, and was assigned a CVSS v3.1 base score of 6.1 (Medium) by NIST NVD (NVD, CVE).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site). It received varying CVSS scores from different sources, with NIST NVD rating it as 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and huntr.dev rating it as 7.2 HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) (NVD).

The vulnerability allows for URL redirection to untrusted sites through the login functionality. When exploited, it could enable attackers to redirect users to malicious websites, potentially leading to phishing attacks or other social engineering attempts (NVD).

The vulnerability was patched in Gitea version 1.16.5. The fix involves implementing additional validation checks for redirect locations, specifically preventing redirects that begin with '//' or '/' as these can be converted by browsers to redirect to external sites (GitHub Patch).