kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document GitLab vulnerabilities

Browse source
This commit is contained in:
Torsten Zuehlsdorff 2017-07-20 08:45:10 +00:00
parent 1e9d410b01
commit 6066f3c6ff
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=446244
1 changed files with 71 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
security/vuxml/vuln.xml
View file

@ -58,6 +58,77 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.0.0</ge><le>8.17.6</le></range>
<range><ge>9.0.0</ge><le>9.0.10</le></range>
<range><ge>9.1.0</ge><le>9.1.7</le></range>
<range><ge>9.2.0</ge><le>9.2.7</le></range>
<range><ge>9.3.0</ge><le>9.4.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
<h1>Projects in subgroups authorization bypass with SQL wildcards
(CVE-2017-11438)</h1>
<p>An internal code review disclosed that by choosing a namespace with
underscores an authenticated user could take advantage of a badly written
SQL query to add themselves to any project inside a subgroup with
permissions of their choice.<br/>
This vulnerability was caused by a SQL query that automatically adjusts
project permissions but does not escape wildcards. This vulnerability was
coincidentally patched when the affected code was rewritten for
9.3. Therefore, versions 9.3 and above are not vulnerable.<br/>
<br/>
This issue has been assigned CVE-2017-11438.<br/>
<br/>
Note: GitLab-CE+EE 8.17 is not vulnerable to this issue, however patches
have been included to improve the security of the SQL queries in 8.17.7.</p>
<h1>Symlink cleanup from a previous security release</h1>
<p>The 9.2.5 security release contained a fix for a data corruption
vulnerability involving file uploads. This fix utilized symlinks to migrate
file uploads to a new directory. Due to a typo in the included migration a
symlink was accidentally left behind after the migration finished. This
symlink can cause problems with instance backups. A fix is included with
these releases to remove the problematic symlink.</p>
<h1>Accidental or malicious use of reserved names in group names could cause
deletion of all snippet uploads</h1>
<p>The 9.2.5 security release contained a fix for a data corruption
vulnerability involving file uploads. After the release of 9.2.5 an internal
code review determined that the recently introduced snippet file uploads
feature was also vulnerable to file deletion. Snippet uploads have now been
moved into the protected system namespace.</p>
<h1>Project name leak on todos page</h1>
<p>An internal code review discovered that forceful browsing could be
utilized to disclose the names of private projects.</p>
<h1>Denial of Service via regular expressions in CI process</h1>
<p>Lukas Svoboda reported that regular expressions (regex) included with CI
scripts could be utilized to perform a denial-of-service attack on GitLab
instances. GitLab now uses the re2 Regex library to limit regex execution
time.</p>
<h1>Issue title leakage when external issue tracker is enabled</h1>
<p>An internal code review determined that when an external issue tracker is
configured it was possible to discover the titles of all issues in a given
GitLab instance, including issues in private projects and confidential
issues.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
<cvename>CVE-2017-11438</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-20</entry>
</dates>
</vuln>
<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>