Advisories » MGASA-2019-0058

Updated gitolite packages fixes security vulnerability

Publication date: 31 Jan 2019
Modification date: 31 Jan 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-20683

Description

In commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables
rsync, mishandles the rsync command line, which allows attackers to have
a "bad" impact by triggering use of an option other than -v, -n, -q, or
-P (CVE-2018-20683).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=24210
• https://lists.opensuse.org/opensuse-updates/2019-01/msg00062.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20683

SRPMS

6/core

• gitolite-3.6.11-1.mga6