CVE-2018-16976 Race condition in n/a

High 8.1 Published 12 Sep 2018 Updated 16 Sep 2024

Attackers can bypass access controls during Git repository migration in specific configurations, gaining unintended access to repositories.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-16976?

CVE-2018-16976 is a high-severity vulnerability in n/a, published on 12 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

Weakness: CWE-362

Which versions are affected by CVE-2018-16976?

It affects 1 product.

Products include Gitolite Gitolite.

How do I fix CVE-2018-16976?

Upgrade to a fixed version.

Is CVE-2018-16976 being exploited?

There is no known exploitation of CVE-2018-16976 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2018-16976, GHSA-jq3h-g8hj-7pmh, MGASA-2018-0434, UBUNTU-CVE-2018-16976.