Fedora EPEL 7 update for gitolite3



| Updated: 2025-04-24
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-16976
CWE-ID CWE-362
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

gitolite3
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Race condition

EUVDB-ID: #VU31212

Risk: High

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-16976

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

gitolite3: before 3.6.9-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ac179250ba


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###