svn commit: r449827 - head/security/vuxml

Thu Sep 14 10:12:22 UTC 2017

Author: tz
Date: Thu Sep 14 10:12:20 2017
New Revision: 449827
URL: https://svnweb.freebsd.org/changeset/ports/449827

Log:
  Document GitLab vulnerabilities
  
  Security: CVE-2017-5029
  Security: CVE-2016-4738
  Security: https://vuxml.FreeBSD.org/freebsd/6a177c87-9933-11e7-93f7-d43d7e971a1b.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Thu Sep 14 10:08:40 2017	(r449826)
+++ head/security/vuxml/vuln.xml	Thu Sep 14 10:12:20 2017	(r449827)
@@ -58,6 +58,82 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
+    <topic>GitLab -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	      <name>gitlab</name>
+  <range><ge>1.0.0</ge><le>9.3.10</le></range>
+  <range><ge>9.4.0</ge><le>9.4.5</le></range>
+  <range><ge>9.5.0</ge><le>9.5.3</le></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>GitLab reports:</p>
+	<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
+    <h1>Cross-Site Scripting (XSS) vulnerability in profile names</h1>
+	  <p>An external security audit performed by Madison Gurkha disclosed a
+	  Cross-Site Scripting (XSS) vulnerability in user names that could be
+	  exploited in several locations.</p>
+    <h1>Open Redirect in go-get middleware</h1>
+    <p>Tim Goddard via HackerOne reported that GitLab was vulnerable to an open
+    redirect vulnerability caused when a specific flag is passed to the go-get
+    middleware. This vulnerability could also possibly be used to conduct
+    Cross-Site Scripting attacks.</p>
+    <h1>Race condition in project uploads</h1>
+    <p>Jobert Abma from HackerOne reported that GitLab was vulnerable to a race
+    condition in project uploads. While very difficult to exploit this race
+    condition could potentially allow an attacker to overwrite a victim's
+    uploaded project if the attacker can guess the name of the uploaded file
+    before it is extracted.</p>
+    <h1>Cross-Site Request Forgery (CSRF) token leakage</h1>
+    <p>naure via HackerOne reported that GitLab was vulnerable to CSRF token
+    leakage via improper filtering of external URLs in relative URL creation. A
+    specially crafted link configured in a project's environments settings could
+    be used to steal a visiting user's CSRF token.</p>
+    <h1>Potential project disclosure via project deletion bug</h1>
+    <p>An internal code review discovered that removed projects were not always
+    being deleted from the file system. This could allow an attacker who knew
+    the full path to a previously deleted project to steal a copy of the
+    repository. These releases prevent the leftover repository from being
+    accessed when creating a new project. The project deletion bug will be fixed
+    in a later release.</p>
+    <h1>White-listed style attribute for table contents in MD enables UI
+    redressing</h1>
+    <p>An external security audit performed by Recurity-Labs discovered a UI
+    redressing vulnerability in the GitLab markdown sanitization library.</p>
+    <h1>DOM clobbering in sanitized MD causes errors</h1>
+    <p>An external security audit performed by Recurity-Labs discovered a DOM
+    clobbering vulnerability in the GitLab markdown sanitization library that
+    could be used to render project pages unreadable.</p>
+    <h1>Nokogiri vendored libxslt library vulnerable to potential integer
+    overflow (CVE-2017-5029 and CVE-2016-4738)</h1>
+    <p>The bundled Nokogiri library has been updated to patch an integer
+    overflow vulnerability. Details are available in the Nokogiri issue.</p>
+    <h1>Security risk in recommended Geo configuration could give all users
+    access to all repositories</h1>
+    <p>An internal code review discovered that GitLab Geo instances could be
+    vulnerable to an attack that would allow any user on the primary Geo
+    instance to clone any repository on a secondary Geo instance.</p>
+    <h1>GitLab Pages private certificate disclosure via symlinks</h1>
+    <p>An external security review conducted by Recurity-Labs discovered a
+    vulnerability in GitLab Pages that could be used to disclose the contents of
+    private SSL keys.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
+      <cvename>CVE-2017-5029</cvename>
+      <cvename>CVE-2016-4738</cvename>
+    </references>
+    <dates>
+      <discovery>2017-09-07</discovery>
+      <entry>2017-09-14</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
     <topic>Flash Player -- multiple vulnerabilities</topic>
     <affects>
