kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document gitlab vulnerabilities.

Browse source
This commit is contained in:
Matthias Fechner 2019-10-30 18:47:59 +00:00
parent 44db66f15b
commit 9e986d1a19
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=516098
1 changed files with 62 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
security/vuxml/vuln.xml
View file

@ -58,6 +58,68 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="6eddfa51-fb44-11e9-86e9-001b217b3468">
<topic>Gitlab -- Disclosure Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.4.0</ge><lt>12.4.1</lt></range>
<range><ge>12.3.0</ge><lt>12.3.6</lt></range>
<range><ge>0</ge><lt>12.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/">
<p>Source branch of a MR could be removed by an unauthorised user</p>
<p>Private group members could be listed</p>
<p>Disclosure of System Notes via Elasticsearch integration</p>
<p>Disclosure of Private Comments via Elasticsearch integration</p>
<p>Confirm existence of private repositories</p>
<p>Private group membership could be disclosed</p>
<p>Disclosure of Project Labels</p>
<p>Disclosure of Private Project Path and Labels</p>
<p>Uncontrolled Resource Consumption due to Nested GraphQL Queries</p>
<p>Improper access control on comments</p>
<p>Sentry Token Access Control</p>
<p>Authorisation check for Project Transfer option</p>
<p>XSS in Wiki Pages Using RDoc</p>
<p>Untrusted Input could be used for Internal Redirect</p>
<p>Access control for protected environments</p>
<p>Private Sub Group path Disclosure</p>
<p>Disclosure of Group Packages List</p>
<p>Private Repository Name Disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/</url>
<cvename>CVE-2019-18446</cvename>
<cvename>CVE-2019-18447</cvename>
<cvename>CVE-2019-18460</cvename>
<cvename>CVE-2019-18456</cvename>
<cvename>CVE-2019-18448</cvename>
<cvename>CVE-2019-18449</cvename>
<cvename>CVE-2019-18450</cvename>
<cvename>CVE-2019-18452</cvename>
<cvename>CVE-2019-18455</cvename>
<cvename>CVE-2019-18453</cvename>
<cvename>CVE-2019-18457</cvename>
<cvename>CVE-2019-18458</cvename>
<cvename>CVE-2019-18454</cvename>
<cvename>CVE-2019-18451</cvename>
<cvename>CVE-2019-18459</cvename>
<cvename>CVE-2019-18461</cvename>
<cvename>CVE-2019-18463</cvename>
<cvename>CVE-2019-18462</cvename>
</references>
<dates>
<discovery>2019-10-30</discovery>
<entry>2019-10-30</entry>
</dates>
</vuln>
<vuln vid="53b3474c-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat</topic>
<affects>