Product:

Gitolite

(Gitolite)
Repositories https://github.com/sitaramc/gitolite
#Vulnerabilities 7
Date Id Summary Products Score Patch Annotated
2012-10-22 CVE-2012-4506 Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name. Gitolite, Gitolite N/A
2018-09-12 CVE-2018-16976 Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access. Gitolite 8.1
2018-09-21 CVE-2013-4451 gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs. Gitolite 9.8
2019-01-10 CVE-2018-20683 commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P. Gitolite 8.1
2019-11-07 CVE-2010-2447 gitolite before 1.4.1 does not filter src/ or hooks/ from path names. Gitolite N/A
2011-10-04 CVE-2011-1572 Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands. Gitolite N/A
2018-09-21 CVE-2013-7203 gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup. Gitolite 5.5