FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-4506

This CVE name corresponds to:

Entered	Topic
2012-10-15	gitolite -- path traversal vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-4506 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-4506
Phase	Assigned(20120821)

Description

Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.

References

Source	Reference
MLIST	[oss-security] 20121009 CVE Request: gitolite path traversal vulnerability
MLIST	[oss-security] 20121009 Re: CVE Request: gitolite path traversal vulnerability
CONFIRM	https://github.com/sitaramc/gitolite/commit/f636ce3ba3e340569b26d1e47b9d9b62dd8a3bf2
CONFIRM	https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion
BID	55853
SECUNIA	50896
XF	gitolite-security-bypass(79130)