sitaramc/gitolite

sitaramc/gitolite

Releases74

Frequency2 months 2 weeks

Last Releaseabout 1 year ago

Stars8.58K

Hosting git repositories -- Gitolite allows you to setup git hosting on a central server, with very fine-grained access control and many (many!) more powerful features.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2010-2447NVD↗	< 1.4.1	Nov 7, 2019Thursday, 7 November 2019, 20:15	9.8 CRITICAL	7.5 HIGH
gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
CVE-2018-20683NVD↗	< 3.6.11	Jan 10, 2019Thursday, 10 January 2019, 01:29	—	6.8 MEDIUM
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.
CVE-2013-7203NVD↗	<= 3.5.3	Sep 21, 2018Friday, 21 September 2018, 17:29	—	2.1 LOW
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.
CVE-2013-4451NVD↗	>= 3.0, <= 3.5.3	Sep 21, 2018Friday, 21 September 2018, 17:29	—	7.5 HIGH
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
CVE-2018-16976NVD↗	< 3.6.9	Sep 12, 2018Wednesday, 12 September 2018, 22:29	—	5.5 MEDIUM
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
CVE-2012-4506NVD↗	= 3.01, = 3.0, = 3.02, = 3.03, = 3.04	Oct 22, 2012Monday, 22 October 2012, 23:55	—	4.6 MEDIUM
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.
CVE-2011-1572NVD↗	= 0.50, = 0.55, = 0.60, = 0.65, = 0.70, = 0.80, = 0.85, = 0.90, = 0.95, = 1.0, = 1.1, = 1.5.1, = 1.5.2, <= 1.5.9, = 1.4, = 1.4.1, = 1.5.5, = 1.5.6, = 1.4.2, = 1.5, = 1.5.7, = 1.5.8, = 1.2, = 1.3, = 1.5.3, = 1.5.4	Oct 4, 2011Tuesday, 4 October 2011, 10:55	—	6.8 MEDIUM
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.