CVE-2012-4506

Published: 22 October 2012

Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.

Notes

per Debian Only affects 3.x releases

Status

References

• https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion
• https://github.com/sitaramc/gitolite/commit/f636ce3ba3e340569b26d1e47b9d9b62dd8a3bf2
• https://www.cve.org/CVERecord?id=CVE-2012-4506
• NVD
• Launchpad
• Debian