PatchTheCVEgitolite vulnerabilities
Recent CVEs affecting gitolite products. 5 tracked.
gitolite has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2019-11-07. Highest priority: CVE-2013-4451 (score 61/100).
- CVE-2018-20683 HIGH 8.1 UPGRADE commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, wh
- CVE-2018-16976 HIGH 8.1 UPGRADE Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access
- CVE-2013-7203 MEDIUM 5.5 UPGRADE gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors rel
- CVE-2013-4451 CRITICAL 9.8 UPGRADE gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving w
- CVE-2010-2447 CRITICAL 9.8 UPGRADE gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
FAQ
How do I fix gitolite vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gitolite being exploited right now?
None of the tracked gitolite CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gitolite CVE should I patch first?
CVE-2013-4451 currently ranks highest (61/100): gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving w.