Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 689794 (CVE-2018-16976, CVE-2018-20683) - dev-vcs/gitolite-3.6.11: multiple vulnerabilities
Summary: dev-vcs/gitolite-3.6.11: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2018-16976, CVE-2018-20683
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks: 858470
  Show dependency tree
 
Reported: 2019-07-13 18:42 UTC by Matt Turner
Modified: 2022-07-18 16:20 UTC (History)
1 user (show)

See Also:
Package list:
dev-vcs/gitolite-3.6.11
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Turner gentoo-dev 2019-07-13 18:42:28 UTC 
Multiple security vulnerabilities are fixed between the current stable (3.6.6) and 3.6.11 (CVE-2018-20683, CVE-2018-16976)

3.6.11 has been in tree since January with no reported bugs, and the current stable was stabilized 2.5 years ago... this is really bad.

Please Cc arches.

security@: I guess the best thing to do is file bugs for the two CVEs and make this one block them?
Comment 1 Christian Ruppert (idl0r) gentoo-dev 2019-07-15 09:39:27 UTC 
@Arch Teams, please stabilize =dev-vcs/gitolite-3.6.11.
Comment 2 Agostino Sarubbo gentoo-dev 2019-07-15 14:17:29 UTC 
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2019-07-17 15:25:19 UTC 
x86 stable
Comment 4 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-07-29 08:49:30 UTC 
arm stable
Comment 5 Larry the Git Cow gentoo-dev 2019-07-29 15:52:13 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d48ca4261753c87952b602873fa2050d6a03333b

commit d48ca4261753c87952b602873fa2050d6a03333b
Author:     Matt Turner <mattst88@gentoo.org>
AuthorDate: 2019-07-29 15:51:10 +0000
Commit:     Matt Turner <mattst88@gentoo.org>
CommitDate: 2019-07-29 15:51:30 +0000

    dev-vcs/gitolite: Drop old versions
    
    Bug: https://bugs.gentoo.org/689794
    Signed-off-by: Matt Turner <mattst88@gentoo.org>

 dev-vcs/gitolite/Manifest                          |   4 -
 .../files/gitolite-3.6.6-fix-shebang.patch         |  23 -----
 dev-vcs/gitolite/gitolite-3.6.10.ebuild            | 102 ---------------------
 dev-vcs/gitolite/gitolite-3.6.6.ebuild             |  99 --------------------
 dev-vcs/gitolite/gitolite-3.6.7.ebuild             |  99 --------------------
 dev-vcs/gitolite/gitolite-3.6.8.ebuild             | 102 ---------------------
 6 files changed, 429 deletions(-)
Comment 6 Thomas Deutschmann (RETIRED) gentoo-dev 2019-10-26 21:11:17 UTC 
GLSA Vote: No!

Repository is clean, all done!