gitea is a Trojan? can the author explain? #5150

New Issue

GiteaMirror · 2025-11-02T06:16:02-06:00

GiteaMirror commented

2025-11-02 06:16:02 -06:00

Originally created by @VeniVidiVici9 on GitHub (Mar 30, 2020).

183.192.179.16
182.254.52.17
14.18.182.223
61.241.50.63
101.89.19.140
113.96.198.54
59.36.132.240
14.215.156.146

What do these address authors do?
It's like a Trojan. My firewall keeps alarming?
It always connect these addresses silently in the background, can the author explain?

This is the latest version

Originally created by @VeniVidiVici9 on GitHub (Mar 30, 2020). 183.192.179.16 182.254.52.17 14.18.182.223 61.241.50.63 101.89.19.140 113.96.198.54 59.36.132.240 14.215.156.146 What do these address authors do? It's like a Trojan. My firewall keeps alarming? It always connect these addresses silently in the background, can the author explain? This is the latest version

GiteaMirror added the type/question label 2025-11-02 06:16:02 -06:00

GiteaMirror closed this issue

2025-11-02 06:16:02 -06:00

GiteaMirror commented

2025-11-02 06:16:03 -06:00

@lunny commented on GitHub (Mar 30, 2020):

Where did you download the gitea binary? And what's the version? Have you compared the checksum?

@lunny commented on GitHub (Mar 30, 2020): Where did you download the gitea binary? And what's the version? Have you compared the checksum?

GiteaMirror commented

2025-11-02 06:16:03 -06:00

@VeniVidiVici9 commented on GitHub (Mar 30, 2020):

I downloaded a docker image, not a binary file,
Downloaded on this site: https://hub.docker.com,
sha256: 306e7b99e8c6f2f49c43f7ad072904b1eb741bde8314093b7cb4ffe51be508d8
The following is the mirror information:
maintainer maintainers@gitea.io
org.label-schema.build-date 2020-03-19T21: 49: 12Z
org.label-schema.schema-version 1.0
org.label-schema.vcs-ref 7225453d5f
org.label-schema.vcs-url https://github.com/go-gitea/gitea.git

@VeniVidiVici9 commented on GitHub (Mar 30, 2020): I downloaded a docker image, not a binary file, Downloaded on this site: https://hub.docker.com, sha256: 306e7b99e8c6f2f49c43f7ad072904b1eb741bde8314093b7cb4ffe51be508d8 The following is the mirror information: maintainer maintainers@gitea.io org.label-schema.build-date 2020-03-19T21: 49: 12Z org.label-schema.schema-version 1.0 org.label-schema.vcs-ref 7225453d5f4694f69e1a18e42204b52ed9fffc9c org.label-schema.vcs-url https://github.com/go-gitea/gitea.git

GiteaMirror commented

2025-11-02 06:16:03 -06:00

@techknowlogick commented on GitHub (Mar 30, 2020):

Do you have federated avatars enabled? Can you give more details about those connections being made (for example what port is being connected to)?

@techknowlogick commented on GitHub (Mar 30, 2020): Do you have federated avatars enabled? Can you give more details about those connections being made (for example what port is being connected to)?

GiteaMirror commented

2025-11-02 06:16:04 -06:00

@Monter commented on GitHub (Mar 30, 2020):

Do you have any migrations (mirrors) in the repo? I have a lot of them and freshly after starting Gitea immediately tries to refresh them all, which pisses me off and almost kills the CPU in the server.
Strange outgoing connections can come from descriptions of a given repo into which their authors throw various pictures, graphics, links, etc.

@Monter commented on GitHub (Mar 30, 2020): Do you have any migrations (mirrors) in the repo? I have a lot of them and freshly after starting Gitea immediately tries to refresh them all, which pisses me off and almost kills the CPU in the server. Strange outgoing connections can come from descriptions of a given repo into which their authors throw various pictures, graphics, links, etc.

GiteaMirror commented

2025-11-02 06:16:04 -06:00

@VeniVidiVici9 commented on GitHub (Mar 31, 2020):

My situation is similar to yours, I also encountered a situation similar to illegal login，such as belowing:

------------------ 原始邮件 ------------------
发件人: "Mark eM"<notifications@github.com>;
发送时间: 2020年3月30日(星期一) 晚上10:03
收件人: "go-gitea/gitea"<gitea@noreply.github.com>;
抄送: "104561102"<104561102@qq.com>;"State change"<state_change@noreply.github.com>;
主题: Re: [go-gitea/gitea] gitea is a Trojan? can the author explain? (#10888)

Do you have any migrations in the repo? I have a lot of them and freshly after starting Gitea immediately tries to refresh them all, which pisses me off and almost kills the CPU in the server.
Strange outgoing connections can come from descriptions of a given repo into which their authors throw various pictures, graphics, links, etc.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub, or unsubscribe.

@VeniVidiVici9 commented on GitHub (Mar 31, 2020): My situation is similar to yours, I also encountered a situation similar to illegal login，such as belowing: ------------------ 原始邮件 ------------------ 发件人: "Mark eM"<notifications@github.com>; 发送时间: 2020年3月30日(星期一) 晚上10:03 收件人: "go-gitea/gitea"<gitea@noreply.github.com>; 抄送: "104561102"<104561102@qq.com>;"State change"<state_change@noreply.github.com>; 主题: Re: [go-gitea/gitea] gitea is a Trojan? can the author explain? (#10888) Do you have any migrations in the repo? I have a lot of them and freshly after starting Gitea immediately tries to refresh them all, which pisses me off and almost kills the CPU in the server. Strange outgoing connections can come from descriptions of a given repo into which their authors throw various pictures, graphics, links, etc. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or unsubscribe.

GiteaMirror commented

2025-11-02 06:16:05 -06:00

@VeniVidiVici9 commented on GitHub (Mar 31, 2020):

Yes, I have the federated avatars enabled, these connections communicate via http port 3000 by default.
I also encountered a situation similar to illegal login，such as belowing:

=========================================================================================================================================================

Do you have federated avatars enabled? Can you give more details about those connections being made (for example what port is being connected to)?

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub, or unsubscribe.

@VeniVidiVici9 commented on GitHub (Mar 31, 2020): Yes, I have the federated avatars enabled, these connections communicate via http port 3000 by default. I also encountered a situation similar to illegal login，such as belowing: ========================================================================================================================================================= Do you have federated avatars enabled? Can you give more details about those connections being made (for example what port is being connected to)? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or unsubscribe.

GiteaMirror commented

2025-11-02 06:16:05 -06:00

@VeniVidiVici9 commented on GitHub (Mar 31, 2020):

I use a container, not a binary file, and the version number is: 1.12.0 + dev-69-g972b3bf3b.

checksum is sha256:c4a654eb05c032eac9ee57de853c725de6169f93f0a45ccd506c7bf4bed03fe5

I have compared the information in the build log.

The checksum is the same on the Docker Hub official website server.

Checksum on Docker Hub official website server:

and the following is my build image log:

I encountered a situation similar to illegal login，such as belowing:

================================================================================================================================

Where did you download the gitea binary? And what's the version? Have you compared the checksum?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

@VeniVidiVici9 commented on GitHub (Mar 31, 2020): I use a container, not a binary file, and the version number is: 1.12.0 + dev-69-g972b3bf3b. checksum is sha256:c4a654eb05c032eac9ee57de853c725de6169f93f0a45ccd506c7bf4bed03fe5 I have compared the information in the build log. The checksum is the same on the Docker Hub official website server. Checksum on Docker Hub official website server: and the following is my build image log: I encountered a situation similar to illegal login，such as belowing: ================================================================================================================================ Where did you download the gitea binary? And what's the version? Have you compared the checksum? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

GiteaMirror commented

2025-11-02 06:16:05 -06:00

@Monter commented on GitHub (Mar 31, 2020):

Please stop spamming and cut out unnecessary items and headers before posting.

@Monter commented on GitHub (Mar 31, 2020): Please stop spamming and cut out unnecessary items and headers before posting.

GiteaMirror commented

2025-11-02 06:16:05 -06:00

@lunny commented on GitHub (Mar 31, 2020):

As @lafriks said, Gitea will not visit other special external sites. If you care about that, you can compile the binary or docker from source.

@lunny commented on GitHub (Mar 31, 2020): As @lafriks said, Gitea will not visit other special external sites. If you care about that, you can compile the binary or docker from source.

GiteaMirror referenced this issue

2025-11-02 14:57:21 -06:00

[PR #5168] [MERGED] Fix emojis not showing in commit messages #17677

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5150