——————————————————————————–
Fedora Update Notification
FEDORA-2013-23953
2013-12-25 01:41:16
——————————————————————————–

Name : gitolite3
Product : Fedora 19
Version : 3.5.3.1
Release : 1.fc19
URL : http://github.com/sitaramc/gitolite
Summary : Highly flexible server for git directory version tracker
Description :
Gitolite allows a server to host many git repositories and provide access
to many developers, without having to give them real userids on the server.
The essential magic in doing this is ssh’s pubkey access and the authorized
keys file, and the inspiration was an older program called gitosis.

Gitolite can restrict who can read from (clone/fetch) or write to (push) a
repository. It can also restrict who can push to what branch or tag, which
is very important in a corporate environment. Gitolite can be installed
without requiring root permissions, and with no additional software than git
itself and perl. It also has several other neat features described below and
elsewhere in the doc/ directory.

——————————————————————————–
Update Information:

Gitolite was found to be vulnerable to local filesystem information leak, where it could create world writable files in the repositories (particularly the gitolite-admin one) depending on the user umask running gitolite setup.
——————————————————————————–
ChangeLog:

* Wed Oct 23 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.3.1-1
– Latest upstream.
* Wed Oct 16 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.3-1
– Latest upstream.
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 1:3.5.2-3
– Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> – 1:3.5.2-2
– Perl 5.18 rebuild
* Wed Jul 10 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.2-1
– Latest upstream.
——————————————————————————–
References:

[ 1 ] Bug #1046230 – CVE-2013-7203 gitolite3: gitolite: world writable files for fresh installs [fedora-19]
https://bugzilla.redhat.com/show_bug.cgi?id=1046230
[ 2 ] Bug #1046232 – CVE-2013-7203 gitolite3: gitolite: world writable files for fresh installs [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1046232
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update gitolite3’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce

——————————————————————————–
Fedora Update Notification
FEDORA-2013-23951
2013-12-25 01:41:12
——————————————————————————–

Name : gitolite3
Product : Fedora 18
Version : 3.5.3.1
Release : 1.fc18
URL : http://github.com/sitaramc/gitolite
Summary : Highly flexible server for git directory version tracker
Description :
Gitolite allows a server to host many git repositories and provide access
to many developers, without having to give them real userids on the server.
The essential magic in doing this is ssh’s pubkey access and the authorized
keys file, and the inspiration was an older program called gitosis.

Gitolite can restrict who can read from (clone/fetch) or write to (push) a
repository. It can also restrict who can push to what branch or tag, which
is very important in a corporate environment. Gitolite can be installed
without requiring root permissions, and with no additional software than git
itself and perl. It also has several other neat features described below and
elsewhere in the doc/ directory.

——————————————————————————–
Update Information:

Gitolite was found to be vulnerable to local filesystem information leak, where it could create world writable files in the repositories (particularly the gitolite-admin one) depending on the user umask running gitolite setup.
——————————————————————————–
ChangeLog:

* Wed Oct 23 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.3.1-1
– Latest upstream.
* Wed Oct 16 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.3-1
– Latest upstream.
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 1:3.5.2-3
– Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> – 1:3.5.2-2
– Perl 5.18 rebuild
* Wed Jul 10 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.2-1
– Latest upstream.
* Thu Mar 28 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5.1-1
– Latest upstream.
* Mon Mar 25 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.5-1
– Latest upstream.
* Tue Mar 5 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.4-1
– Latest upstream.
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 1:3.3-2
– Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Thu Jan 3 2013 Jon Ciesla <limburgher@gmail.com> – 1:3.3-1
– Latest upstream.
* Mon Nov 19 2012 Jon Ciesla <limburgher@gmail.com> – 1:3.2-1
– Latest upstream.
* Wed Oct 10 2012 Jon Ciesla <limburgher@gmail.com> – 1:3.1-1
– 3.1, rewuiring Epoch bump.
——————————————————————————–
References:

[ 1 ] Bug #1046230 – CVE-2013-7203 gitolite3: gitolite: world writable files for fresh installs [fedora-19]
https://bugzilla.redhat.com/show_bug.cgi?id=1046230
[ 2 ] Bug #1046232 – CVE-2013-7203 gitolite3: gitolite: world writable files for fresh installs [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1046232
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update gitolite3’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce