Unrated
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the proce...
CVE-2018-16976
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-16976 gitolite3 Fixed in: 3.6.9-1
- Ubuntu UBUNTU-CVE-2018-16976 gitolite3
Original description The description as published by the source.
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
References
- patch bugs.debian.org
- patch github.com
- web groups.google.com