From ${URL} : Gitolite was found to be vulnerable to local filesystem information leak, where it could create world writable files in the repositories (particularly the gitolite-admin one) depending on the user umask running gitolite setup. http://seclists.org/oss-sec/2013/q4/542 @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
I haven't used 3.x so far but I think it should be ok to stabilize 3.5.3.1.
I don't think this applies to us, since the only 3.x version in tree is ~.
Additional information: https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3
This was fixed when https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/dev-vcs/gitolite/gitolite-3.5.3.1.ebuild?hideattic=0&view=log hit the tree. @ Security: Please vote!
Vulnerable code is not present in 2.3.1.