Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict     access to a Git repository that is in the process of being migrated until the full set of migration steps     has been completed. This can allow valid users to obtain unintended access. (CVE-2018-16976)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for gitolite fixes the following issues :

Gitolite was updated to 3.6.9 :

  - CVE-2018-16976: prevent racy access to repos in process     of migration to gitolite (boo#1108272)

  - 'info' learns new '-p' option to show only physical     repos (as opposed to wild repos)

The update to 3.6.8 contains :

  - fix bug when deleting *all* hooks for a repo

  - allow trailing slashes in repo names

  - make pre-receive hook driver bail on non-zero exit of a     pre-receive hook

  - allow templates in gitolite.conf (new feature)

  - various optimiations

The update to 3.6.7 contains :

  - allow repo-specific hooks to be organised into     subdirectories, and allow the multi-hook driver to be     placed in some other location of your choice

  - allow simple test code to be embedded within the     gitolite.conf file; see contrib/utils/testconf for how.
    (This goes on the client side, not on the server)

  - allow syslog 'facility' to be changed, from the default     of 'local0'

  - allow syslog 'facility' to be changed, from the default     of replaced with a space separated list of members

The update to 3.6.6 contains :

  - simple but important fix for a future perl deprecation     (perl will be removing '.' from @INC in 5.24)

  - 'perms' now requires a '-c' to activate batch mode     (should not affect interactive use but check your     scripts perhaps?)

  - gitolite setup now accepts a '-m' option to supply a     custom message (useful when it is used by a script)

3.6.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

See: https://nvd.nist.gov/vuln/detail/CVE-2018-16976

ID	Name	Product	Family	Severity
259322	Linux Distros Unpatched Vulnerability : CVE-2018-16976	Nessus	Misc.	high
123324	openSUSE Security Update : gitolite (openSUSE-2019-754)	Nessus	SuSE Local Security Checks	high
120844	Fedora 28 : 1:gitolite3 (2018-dc060c6f2a)	Nessus	Fedora Local Security Checks	high
120810	Fedora 29 : 1:gitolite3 (2018-d0bac4ff3b)	Nessus	Fedora Local Security Checks	high
118212	Amazon Linux AMI : gitolite3 (ALAS-2018-1092)	Nessus	Amazon Linux Local Security Checks	high
117978	openSUSE Security Update : gitolite (openSUSE-2018-1118)	Nessus	SuSE Local Security Checks	high
117648	Fedora 27 : 1:gitolite3 (2018-7993dea41b)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-16976

high

Tenable Plugins

high

high

high

high

high

high

high