CVE-2018-16976 Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migrati...
HighCVSS 8.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/gitolite3(Debian:12) | < 3.6.9-1 | 3.6.9-1 |
| debian/gitolite3(Debian:13) | < 3.6.9-1 | 3.6.9-1 |
| debian/gitolite3(Debian:14) | < 3.6.9-1 | 3.6.9-1 |
| gitolite | < 3.6.9 | 3.6.9 |
| ubuntu/gitolite3(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/gitolite3(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/gitolite3(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/gitolite3(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-16976 vendor-advisory
- bugs.debian.org issue-tracking mailing-list patch third-party-advisory
- github.com patch third-party-advisory
- groups.google.com