Advisories » MGASA-2018-0434

Updated gitolite packages fix security vulnerability

Publication date: 03 Nov 2018
Modification date: 03 Nov 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-16976

Description

Updated gitolite package fixes security vulnerability:

Gitolite before 3.6.9 does not (in certain configurations involving @all
or a regex) properly restrict access to a Git repository that is in the
process of being migrated until the full set of migration steps has been
completed. This   can allow valid users to obtain unintended access
(CVE-2018-16976).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23680
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FW77TT3SZUDFVK3UYO6WNT7GFUHWXDUO/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16976

SRPMS

6/core

• gitolite-3.6.10-1.mga6