Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann eine Schwachstelle in GitLab ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herzustellen oder Informationen offenzulegen.
Product
GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.
Vulnerabilities 7
-
High 7.3
Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a vic…
-
High 7.0
Insecure path handling in Bundler
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…
-
Medium 6.2
Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's enc…
-
Medium 5.3
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed meth…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is w…
-
Medium 4.3
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting…
Revision history
-
#6
Neue Updates von Gentoo aufgenommen
-
#5
CVE ergänzt
-
#4
Neue Updates von Oracle Linux aufgenommen
-
#3
CVE's ergänzt
-
#2
Neue Updates von Arch Linux aufgenommen
-
#1
Initiale Fassung
References
-
GitLab Security Release: 13.7.2, 13.6.4 & 13.5.6 vom 2021-01-07
https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2-released/
-
Arch Linux Security Advisory ASA-202101-10 vom 2021-01-13
https://security.archlinux.org/ASA-202101-10/generate
-
Oracle Linux Security Advisory ELSA-2021-2588 vom 2021-07-08
http://linux.oracle.com/errata/ELSA-2021-2588.html
-
Gentoo Linux Security Advisory GLSA-202408-22 vom 2024-08-10
https://security.gentoo.org/glsa/202408-22