OpenSUSE Linux update for gitolite



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-16976
CWE-ID CWE-362
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Linux
Operating systems & Components / Operating system

Opensuse
Operating systems & Components / Operating system

Vendor SUSE

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Race condition

EUVDB-ID: #VU31212

Risk: High

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-16976

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

Mitigation

Update the affected packages.

Vulnerable software versions

SUSE Linux: 15

Opensuse: 15.0 - 42.3

CPE2.3 External links

https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00010.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###