Security update for gitolite SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:3035-1 Final 1 1 2018-10-05T16:02:35Z current 2018-10-05T16:02:35Z 2018-10-05T16:02:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gitolite This update for gitolite fixes the following issues: Gitolite was updated to 3.6.9: - CVE-2018-16976: prevent racy access to repos in process of migration to gitolite (boo#1108272) - 'info' learns new '-p' option to show only physical repos (as opposed to wild repos) The update to 3.6.8 contains: - fix bug when deleting *all* hooks for a repo - allow trailing slashes in repo names - make pre-receive hook driver bail on non-zero exit of a pre-receive hook - allow templates in gitolite.conf (new feature) - various optimiations The update to 3.6.7 contains: - allow repo-specific hooks to be organised into subdirectories, and allow the multi-hook driver to be placed in some other location of your choice - allow simple test code to be embedded within the gitolite.conf file; see contrib/utils/testconf for how. (This goes on the client side, not on the server) - allow syslog "facility" to be changed, from the default of 'local0' - allow syslog "facility" to be changed, from the default of replaced with a space separated list of members The update to 3.6.6 contains: - simple but important fix for a future perl deprecation (perl will be removing "." from @INC in 5.24) - 'perms' now requires a '-c' to activate batch mode (should not affect interactive use but check your scripts perhaps?) - gitolite setup now accepts a '-m' option to supply a custom message (useful when it is used by a script) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00010.html E-Mail link for openSUSE-SU-2018:3035-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub for SUSE Linux Enterprise 15 gitolite-3.6.9-bp150.3.3.1 gitolite-3.6.9-bp150.3.3.1 as a component of SUSE Package Hub for SUSE Linux Enterprise 15 Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access. CVE-2018-16976 SUSE Package Hub for SUSE Linux Enterprise 15:gitolite-3.6.9-bp150.3.3.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00010.html https://www.suse.com/security/cve/CVE-2018-16976.html CVE-2018-16976 https://bugzilla.suse.com/1108272 SUSE Bug 1108272