Skip to main content

This post is from the CollabNet VersionOne blog and has not been updated since the original publish date.

Last Updated Jun 26, 2013 — Enterprise Agile Planning expert

Security fix for Gerrit – Please update your TeamForge Git Integration if you use branch based permissions

Enterprise Agile Planning

This week, we learned about a security problem in core Gerrit related to read related branch based permissions. The original issue can be found here.

If you do not use branch based read permission on your Gerrit server, you are not affected at all. The default repo categories configured with TeamForge do not use those, so as long you do not have any repositories using the custom repository category, there is no issue at all. If you are using the custom repository category and have configured read branch based permisisons, it is possible under certain conditions ( iff the atacker knows a SHA-1 of a commit that is normally not available to him) to get access to protected commits with a modified git client. This access is only possible for users who have at least access to some branch of this repository, so in the worst case, to TF project members you should only have partial read access (in no case to the outside world or non project members).

In order to fix this issue, you would have to upgrade our Gerrit integration to the newest version 7.1.2:
yum update ctf-git-integration

For further questions, please contact your CollabNet contact or comment on this blog post.

Best, Johannes

More from the Blog

View more
Feb 14, 2021

Reflecting on the 20th anniversary of the Agile Manifesto

Enterprise Agile Planning
Over the past 20 years, it’s been amazing to watch an idea from ...
Read More
Feb 08, 2021

How does agile apply to an entire organization?

Enterprise Agile Planning
Before we dive into the main subject of this blog post, it is importan ...
Read More
Feb 03, 2021

It took a pandemic to realize why digital transformation actually matters

Enterprise Agile Planning
Before anyone had ever heard of COVID-19, businesses across the globe ...
Read More
Jan 27, 2021

Improve visibility, reduce costs, and take back control of your scaled out container and cloud deployments with the latest releases of Digital.ai Agility and DevOps solutions

Enterprise Agile Planning
We’re thrilled to announce the latest releases of our Digital.ai Agili ...
Read More
Contact Us