diff options
| author | tz <tz@FreeBSD.org> | 2017-08-11 16:05:09 +0800 |
|---|---|---|
| committer | tz <tz@FreeBSD.org> | 2017-08-11 16:05:09 +0800 |
| commit | 085dd78ebb24d6630feb6cb0b3c9698510b7c57b (patch) | |
| tree | 14c44a9925b62013492e501154cc03888f30612a | |
| parent | f5dc7fa457bb15c31b1774c356f380e395779469 (diff) | |
| download | freebsd-ports-gnome-085dd78ebb24d6630feb6cb0b3c9698510b7c57b.tar.gz freebsd-ports-gnome-085dd78ebb24d6630feb6cb0b3c9698510b7c57b.tar.zst freebsd-ports-gnome-085dd78ebb24d6630feb6cb0b3c9698510b7c57b.zip | |
Document GitLab vulnerabilities
Security: CVE-2017-12426
Security: https://vuxml.FreeBSD.org/freebsd/abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b.html
| -rw-r--r-- | security/vuxml/vuln.xml | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 9612182f28d4..41af325648d2 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,62 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b"> + <topic>GitLab -- two vulnerabilities</topic> + <affects> + <package> + <name>gitlab</name> + <range><ge>7.9.0</ge><le>8.17.8</le></range> + <range><ge>9.0.0</ge><le>9.0.12</le></range> + <range><ge>9.1.0</ge><le>9.1.9</le></range> + <range><ge>9.2.0</ge><le>9.2.9</le></range> + <range><ge>9.3.0</ge><le>9.3.9</le></range> + <range><ge>9.4.0</ge><le>9.4.3</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>GitLab reports:</p> + <blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/"> + <h1>Remote Command Execution in git client</h1> + <p>An external code review performed by Recurity-Labs identified a remote + command execution vulnerability in git that could be exploited via the "Repo + by URL" import option in GitLab. The command line git client was not + properly escaping command line arguments in URLs using the SSH protocol + before invoking the SSH client. A specially crafted URL could be used to + execute arbitrary shell commands on the GitLab server.<br/> + To fully patch this vulnerability two fixes were needed. The Omnibus + versions of GitLab contain a patched git client. For source users who may + still be running an older version of git, GitLab now also blocks import URLs + containing invalid host and usernames.<br/> + This issue has been assigned CVE-2017-12426.</p> + <h1>Improper sanitization of GitLab export files on import</h1> + <p>GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a + patch for a critical directory traversal vulnerability in the GitLab export + feature that could be exploited by including symlinks in the export file and + then re-importing it to a GitLab instance. This vulnerability was patched by + checking for and removing symlinks in these files on import.<br/> + Recurity-Labs also determined that this fix did not properly remove symlinks for + hidden files. Though not as dangerous as the original vulnerability hidden file + symlinks could still be used to steal copies of git repositories belonging to + other users if the path to the git repository was known by the attacker. An + updated fix has been included in these releases that properly removes all + symlinks.<br/> + This import option was not made available to non-admin users until GitLab + 8.13.0.</p> + </blockquote> + </body> + </description> + <references> + <url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url> + <cvename>CVE-2017-12426</cvename> + </references> + <dates> + <discovery>2017-08-10</discovery> + <entry>2017-08-11</entry> + </dates> + </vuln> + <vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730"> <topic>PostgreSQL vulnerabilities</topic> <affects> |