svn commit: r446244 - head/security/vuxml
Torsten Zuehlsdorff
tz at FreeBSD.org
Thu Jul 20 08:45:12 UTC 2017
Author: tz
Date: Thu Jul 20 08:45:10 2017
New Revision: 446244
URL: https://svnweb.freebsd.org/changeset/ports/446244
Log:
Document GitLab vulnerabilities
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Jul 20 04:15:24 2017 (r446243)
+++ head/security/vuxml/vuln.xml Thu Jul 20 08:45:10 2017 (r446244)
@@ -58,6 +58,77 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
+ <topic>GitLab -- Various security issues</topic>
+ <affects>
+ <package>
+ <name>gitlab</name>
+ <range><ge>8.0.0</ge><le>8.17.6</le></range>
+ <range><ge>9.0.0</ge><le>9.0.10</le></range>
+ <range><ge>9.1.0</ge><le>9.1.7</le></range>
+ <range><ge>9.2.0</ge><le>9.2.7</le></range>
+ <range><ge>9.3.0</ge><le>9.4.7</le></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>GitLab reports:</p>
+ <blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
+ <h1>Projects in subgroups authorization bypass with SQL wildcards
+ (CVE-2017-11438)</h1>
+ <p>An internal code review disclosed that by choosing a namespace with
+ underscores an authenticated user could take advantage of a badly written
+ SQL query to add themselves to any project inside a subgroup with
+ permissions of their choice.<br/>
+ This vulnerability was caused by a SQL query that automatically adjusts
+ project permissions but does not escape wildcards. This vulnerability was
+ coincidentally patched when the affected code was rewritten for
+ 9.3. Therefore, versions 9.3 and above are not vulnerable.<br/>
+ <br/>
+ This issue has been assigned CVE-2017-11438.<br/>
+ <br/>
+ Note: GitLab-CE+EE 8.17 is not vulnerable to this issue, however patches
+ have been included to improve the security of the SQL queries in 8.17.7.</p>
+ <h1>Symlink cleanup from a previous security release</h1>
+ <p>The 9.2.5 security release contained a fix for a data corruption
+ vulnerability involving file uploads. This fix utilized symlinks to migrate
+ file uploads to a new directory. Due to a typo in the included migration a
+ symlink was accidentally left behind after the migration finished. This
+ symlink can cause problems with instance backups. A fix is included with
+ these releases to remove the problematic symlink.</p>
+ <h1>Accidental or malicious use of reserved names in group names could cause
+ deletion of all snippet uploads</h1>
+ <p>The 9.2.5 security release contained a fix for a data corruption
+ vulnerability involving file uploads. After the release of 9.2.5 an internal
+ code review determined that the recently introduced snippet file uploads
+ feature was also vulnerable to file deletion. Snippet uploads have now been
+ moved into the protected system namespace.</p>
+ <h1>Project name leak on todos page</h1>
+ <p>An internal code review discovered that forceful browsing could be
+ utilized to disclose the names of private projects.</p>
+ <h1>Denial of Service via regular expressions in CI process</h1>
+ <p>Lukas Svoboda reported that regular expressions (regex) included with CI
+ scripts could be utilized to perform a denial-of-service attack on GitLab
+ instances. GitLab now uses the re2 Regex library to limit regex execution
+ time.</p>
+ <h1>Issue title leakage when external issue tracker is enabled</h1>
+ <p>An internal code review determined that when an external issue tracker is
+ configured it was possible to discover the titles of all issues in a given
+ GitLab instance, including issues in private projects and confidential
+ issues.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
+ <cvename>CVE-2017-11438</cvename>
+ </references>
+ <dates>
+ <discovery>2017-07-20</discovery>
+ <entry>2017-07-20</entry>
+ </dates>
+ </vuln>
+
<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list