From nobody Wed Jan 11 12:38:42 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NsS0M2v20z2sHZr; Wed, 11 Jan 2023 12:38:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NsS0M24XFz40CH; Wed, 11 Jan 2023 12:38:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673440723; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ePDUw4IIkQJJu1lPfIrQApG+bEtj9xa9aEhPARVH7wE=; b=H6g1zrhZFe82NxloHY6R8zM+R48GqLXQa2WkgNbqaaZF+SnObPuwkrKC3qgr+gp3Bdrnr8 zqWOksc7N7ZvH9g1E3OBuge53bRKupEQ1796Iw9cZD1hwgq/Ta0PfWmliZVmWMjn0KeYVP I4K7QOp01CisodBuWa3ytsDFETFeZGc3AtngsF/ubn5eKJrxP/yAolGXwooDvGwwm4PdMz 42S9E1yMrYjUOI23YC9fUUN3zDVxTBCozV4Lb6aBySwTTcKlTNvjswM2aq24NxxXxk7uVi f0ZO9GfsOF3PiJajGQsuPwsCP4aiCDK2FRYULLpJQ8hXFROZxfgNbOHvCdU/Bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673440723; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ePDUw4IIkQJJu1lPfIrQApG+bEtj9xa9aEhPARVH7wE=; b=d9e+1D8zL9PggBu8YwHViEiZHX81OdegZs8Vwrg0TcUSWBjbaroN0G3DjgqpJ2XkMEuZD3 32smB+CsxoRiaFrCxv7GNlCc8k/R5NAw5kvTDGZApNWcJDbJczpa+/Ij2dvUpqyqem88Zr iwYwf6pookG5eLMFphVlQEFXEgl+bZOsK4sJfLl0Wgy3wGWSdyb054/1O0g6SnM6PrS6uD z+Tv8ABE3l+SzhIC209Pm5EhZpJ9JiK/pLrz+88YmMKOPJkIKhAH2XG7DU2em3PNkTY2nZ +KrKykMysb3ehxAL7JT4lSUak3ok3+KadgpDhCrC+RUDAxp4FdXR/MJ/tMjW0w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1673440723; a=rsa-sha256; cv=none; b=JC5hqV6aAXph0PTWXEA0Kr7gdXgvWVkueGZWy2J8VQq35F+J4pwBwcVUwVmXc9PgQg94f0 U3a8MvNIYAzmgnP8km6N0c6NEAJiA114DJCdQAF/R7i6ycCdb9YqczLqUNVLX2ulLpui/z a9G1b7IA4yV8cxBMUthjRzVHRIIhpIZ4Bj09MMqUZ6ZMn63rgDGhYbkH8Did68QSWY87pG as4qFGyrwkPLAscn+ogZ0gS3Rrt/3Ck2QwSddFs3QFhPbGl05UA6zqgtjSEc2JfXShphek XaQG/gQxQ/1wACcdTZNA8qcL9kpw37My9Fx+hNKCyEh9pUTzPRBtFuwll4dPkQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4NsS0M0zM3zp6j; Wed, 11 Jan 2023 12:38:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30BCcgv6041568; Wed, 11 Jan 2023 12:38:42 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30BCcgat041567; Wed, 11 Jan 2023 12:38:42 GMT (envelope-from git) Date: Wed, 11 Jan 2023 12:38:42 GMT Message-Id: <202301111238.30BCcgat041567@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Fechner Subject: git: 16583ccb338f - main - security/vuxml: document gitlab-ce vulnerabilities List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mfechner X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 16583ccb338f46983a8a83afd0c162f05fbc9203 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mfechner: URL: https://cgit.FreeBSD.org/ports/commit/?id=16583ccb338f46983a8a83afd0c162f05fbc9203 commit 16583ccb338f46983a8a83afd0c162f05fbc9203 Author: Matthias Fechner AuthorDate: 2023-01-11 12:38:13 +0000 Commit: Matthias Fechner CommitDate: 2023-01-11 12:38:13 +0000 security/vuxml: document gitlab-ce vulnerabilities --- security/vuxml/vuln/2023.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 35895839ff4c..6e8d83ad5616 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,49 @@ + + Gitlab -- Multiple Vulnerabilities + + + gitlab-ce + 15.7.015.7.2 + 15.6.015.6.4 + 6.6.015.5.7 + + + + +

Gitlab reports:

+
+

Race condition on gitlab.com enables verified email forgery and third-party account hijacking

+

DOS and high resource consumption of Prometheus server through abuse of Grafana integration proxy endpoint

+

Maintainer can leak sentry token by changing the configured URL

+

Maintainer can leak masked webhook secrets by changing target URL of the webhook

+

Cross-site scripting in wiki changes page affecting self-hosted instances running without strict CSP

+

Group access tokens continue to work after owner loses ability to revoke them

+

Users' avatar disclosure by user ID in private GitLab instances

+

Arbitrary Protocol Redirection in GitLab Pages

+

Regex DoS due to device-detector parsing user agents

+

Regex DoS in the Submodule Url Parser

+
+ + + + CVE-2022-4037 + CVE-2022-3613 + CVE-2022-4365 + CVE-2022-4342 + CVE-2022-3573 + CVE-2022-4167 + CVE-2022-3870 + CVE-2023-0042 + CVE-2022-4131 + CVE-2022-3514 + https://about.gitlab.com/releases/2023/01/09/security-release-gitlab-15-7-2-released/ + + + 2023-01-09 + 2023-01-11 + + + chromium -- multiple vulnerabilities