Fedora 27: 2018-7993dea41b Critical: Gitolite3 Access Control

Gitolite allows a server to host many git repositories and provide access

to many developers, without having to give them real userids on the server.

The essential magic in doing this is ssh's pubkey access and the authorized

keys file, and the inspiration was an older program called gitosis.

Gitolite can restrict who can read from (clone/fetch) or write to (push) a

repository. It can also restrict who can push to what branch or tag, which

is very important in a corporate environment. Gitolite can be installed

without requiring root permissions, and with no additional software than git

itself and perl. It also has several other neat features described below and

elsewhere in the doc/ directory.

3.6.9

* Tue Sep 11 2018 Gwyn Ciesla - 1:3.6.9-1

- Latest upstream.

* Tue Jul 17 2018 Gwyn Ciesla - 1:3.6.8-1

- Latest upstream.

* Fri Jul 13 2018 Fedora Release Engineering - 1:3.6.7-7

- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

* Wed Jun 27 2018 Jitka Plesnikova - 1:3.6.7-6

- Perl 5.28 rebuild

* Tue Apr 24 2018 Pierre-Yves Chibon - 1:3.6.7-5

- Back upstream patch making gitolite respect the ALLOW_ORPHAN_GL_CONF

configuration variabe

- Include the compile-1 command upstream brought in Fedora in:

https://github.com/sitaramc/gitolite/commit/afb8afa14a892895dc48664c6526351cb

* Wed Feb 7 2018 Fedora Release Engineering - 1:3.6.7-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[ 1 ] Bug #1629930 - CVE-2018-16976 gitolite3: gitolite: Improper restriction of access to a Git repository while migration [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1629930

su -c 'dnf upgrade --advisory FEDORA-2018-7993dea41b' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/