From nobody Fri Mar 31 04:30:12 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PnnQD6yJHz42sJB; Fri, 31 Mar 2023 04:30:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PnnQD6VHDz3xDy; Fri, 31 Mar 2023 04:30:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680237012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=79MzGDi2pRYp3fyMDQ9yg7nQ6takpIMXJ8DeiAJz650=; b=UNozha9R+pbh4vEvZloMeOk8j2HRGFb01Chag4OWnJMRlrPcOS6T+hl65ce2sg2Bi0AWuq YbrSb/MVYE2RRgy4CdUJj1JbDsc3XvkW+RVPyUM13O30/TkwAP6KzrasyI3daEeKwVA0fl sRO5hVBdqFoLz796whIcv8PJzEOV0tgEP+QMk4OKoDLE4uSt4yg+dnFWzE66LssKL+fkP0 tyg2W1GN4vzC1sTU1T1syQaaAgZTVxkRluhy7avsS/5kgl7ywY94acoeFdsej0iBiKBFGe JGxGNuwIrfCxdCDI8LpihWjauQRwIXZI+kjVJN5m+uQ8dNprl38mtxZZcvvp3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680237012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=79MzGDi2pRYp3fyMDQ9yg7nQ6takpIMXJ8DeiAJz650=; b=KulYEZUPtdR99N6hny9PYBEOFqBjJdEcYOMZ1HchQK3GZ0V2QSXalvtaugMl2LXhDADmad kzUuV6TKOVFO5mTu3OPCb07De8HSR+eDzzyUrqiXINEE3M6ghabVvT4EDn3ucYO27DpxU5 JTtpxHCCR3wraaoCx4WTa6YeEK67ztaNXl9lbTfgYm7LtEfEla2jeFUZUxRBATHG6UpCcn hfXs0KsypZ4URZABnbyhw8L39EwyaFMVLg5YlTPDu7cZ5q0+grlOgXU2cYM3iJOVLboeMH i/vL0uo69Y6X+32FKgWoLOZiI5QxByDWJorckv3ctWQd3Ws0YNr42fFfabKBXA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1680237012; a=rsa-sha256; cv=none; b=MZjC20WmKUugTcvx4Wnmu+4V77T9H+B2JUnirWU35T9Ta8mOe+wPkRwA3SaKEVWlNm7RQL X1d8NsAS50Xm7MclvoLnDAlBKi/goKqa1aAuigx1zb88s8CgrwgYixCzxiaOR8+O7qWLJe FXaWDOQ/c4mo2BdRF/oR0v81vqs9jhS/Cwtqg8OlpLKNDVzYFFMHpe7R3uGUplAvmQ8LWO aOgip5TygCSQaAV+iHFnw46aVrG0Q0rZdM6giVnN7+smJvYjWMne/agqjNpTvqQZZrWu5o yx/eUIPFsDw83e0tMWdDp9pCFHpMS7OnJ3Im9IrH7AL3pa100aE9TUDxVLSRzw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PnnQD5YTwzfwm; Fri, 31 Mar 2023 04:30:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 32V4UCrE053546; Fri, 31 Mar 2023 04:30:12 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 32V4UCOq053542; Fri, 31 Mar 2023 04:30:12 GMT (envelope-from git) Date: Fri, 31 Mar 2023 04:30:12 GMT Message-Id: <202303310430.32V4UCOq053542@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Fechner Subject: git: 9b3b685dbff3 - main - security/vuxml: Document gitlab vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mfechner X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9b3b685dbff328ba3c6d9fd8d9af0a55af811dcc Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mfechner: URL: https://cgit.FreeBSD.org/ports/commit/?id=9b3b685dbff328ba3c6d9fd8d9af0a55af811dcc commit 9b3b685dbff328ba3c6d9fd8d9af0a55af811dcc Author: Matthias Fechner AuthorDate: 2023-03-31 04:29:06 +0000 Commit: Matthias Fechner CommitDate: 2023-03-31 04:29:06 +0000 security/vuxml: Document gitlab vulnerabilities --- security/vuxml/vuln/2023.xml | 57 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 7603d7d53531..edb2e5581b48 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,60 @@ + + Gitlab -- Multiple Vulnerabilities + + + gitlab-ce + 15.10.015.10.1 + 15.9.015.9.4 + 8.115.8.5 + + + + +

Gitlab reports:

+
+

Cross-site scripting in "Maximum page reached" page

+

Private project guests can read new changes using a fork

+

Mirror repository error reveals password in Settings UI

+

DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint

+

Unauthenticated users can view Environment names from public projects limited to project members only

+

Copying information to the clipboard could lead to the execution of unexpected commands

+

Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL

+

Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release

+

Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown

+

MR for security reports are available to everyone

+

API timeout when searching for group issues

+

Unauthorised user can add child epics linked to victim's epic in an unrelated group

+

GitLab search allows to leak internal notes

+

Ambiguous branch name exploitation in GitLab

+

Improper permissions checks for moving an issue

+

Private project branches names can be leaked through a fork

+
+ + + + CVE-2022-3513 + CVE-2023-0485 + CVE-2023-1098 + CVE-2023-1733 + CVE-2023-0319 + CVE-2023-1708 + CVE-2023-0838 + CVE-2023-0523 + CVE-2023-0155 + CVE-2023-1167 + CVE-2023-1417 + CVE-2023-1710 + CVE-2023-0450 + CVE-2023-1071 + CVE-2022-3375 + https://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/ + + + 2023-03-30 + 2023-03-31 + + + rubygem-time -- ReDoS vulnerability