git: 9df381bde002 - main - security/vuxml: document gitlab vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 07 Jun 2023 04:44:55 UTC
The branch main has been updated by mfechner:
URL: https://cgit.FreeBSD.org/ports/commit/?id=9df381bde00257ada43e4d5787e23a54bb11aae3
commit 9df381bde00257ada43e4d5787e23a54bb11aae3
Author: Matthias Fechner <mfechner@FreeBSD.org>
AuthorDate: 2023-06-07 04:44:27 +0000
Commit: Matthias Fechner <mfechner@FreeBSD.org>
CommitDate: 2023-06-07 04:44:27 +0000
security/vuxml: document gitlab vulnerabilities
---
security/vuxml/vuln/2023.xml | 55 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 55 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index 03dd12b1eff1..ac76df92ea26 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,58 @@
+ <vuln vid="cdb5338d-04ec-11ee-9c88-001b217b3468">
+ <topic>Gitlab -- Vulnerability</topic>
+ <affects>
+ <package>
+ <name>gitlab-ce</name>
+ <range><ge>16.0.0</ge><lt>16.0.2</lt></range>
+ <range><ge>15.11.0</ge><lt>15.11.7</lt></range>
+ <range><ge>15.10.0</ge><lt>15.10.8</lt></range>
+ <range><ge>1.2</ge><lt>15.9.8</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Gitlab reports:</p>
+ <blockquote cite="https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/">
+ <p>Stored-XSS with CSP-bypass in Merge requests</p>
+ <p>ReDoS via FrontMatterFilter in any Markdown fields</p>
+ <p>ReDoS via InlineDiffFilter in any Markdown fields</p>
+ <p>ReDoS via DollarMathPostFilter in Markdown fields</p>
+ <p>DoS via malicious test report artifacts</p>
+ <p>Restricted IP addresses can clone repositories of public projects</p>
+ <p>Reflected XSS in Report Abuse Functionality</p>
+ <p>Privilege escalation from maintainer to owner by importing members from a project</p>
+ <p>Bypassing tags protection in GitLab</p>
+ <p>Denial of Service using multiple labels with arbitrarily large descriptions</p>
+ <p>Ability to use an unverified email for public and commit emails</p>
+ <p>Open Redirection Through HTTP Response Splitting</p>
+ <p>Disclosure of issue notes to an unauthorized user when exporting a project</p>
+ <p>Ambiguous branch name exploitation</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-2442</cvename>
+ <cvename>CVE-2023-2199</cvename>
+ <cvename>CVE-2023-2198</cvename>
+ <cvename>CVE-2023-2132</cvename>
+ <cvename>CVE-2023-0121</cvename>
+ <cvename>CVE-2023-2589</cvename>
+ <cvename>CVE-2023-2015</cvename>
+ <cvename>CVE-2023-2485</cvename>
+ <cvename>CVE-2023-2001</cvename>
+ <cvename>CVE-2023-0921</cvename>
+ <cvename>CVE-2023-1204</cvename>
+ <cvename>CVE-2023-0508</cvename>
+ <cvename>CVE-2023-1825</cvename>
+ <cvename>CVE-2023-2013</cvename>
+ <url>https://about.gitlab.com/releases/2023/06/05/security-release-gitlab-16-0-2-released/</url>
+ </references>
+ <dates>
+ <discovery>2023-06-05</discovery>
+ <entry>2023-06-07</entry>
+ </dates>
+ </vuln>
+
<vuln vid="2f38c6a2-04a4-11ee-8cb0-e41f13b9c674">
<topic>qpress -- directory traversal</topic>
<affects>