CVE-2013-4451 gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repo...
CriticalCVSS 9.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitolite | >= 3.0, <= 3.5.3 | No fix listed |
References
- github.com patch third-party-advisory
- groups.google.com
- [oss-security] 20131021 Re: CVE Request: gitolite world writable files for fresh installs of v3.5.3 mailing-list patch
- 63237 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2013-4451 vendor-advisory