svn commit: r456287 - head/security/vuxml

Thu Dec 14 10:58:48 UTC 2017

Author: tz
Date: Thu Dec 14 10:58:46 2017
New Revision: 456287
URL: https://svnweb.freebsd.org/changeset/ports/456287

Log:
  Document GitLab Vulnerability
  
  Security: https://vuxml.FreeBSD.org/freebsd/e72a8864-e0bc-11e7-b627-d43d7e971a1b.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Thu Dec 14 10:07:04 2017	(r456286)
+++ head/security/vuxml/vuln.xml	Thu Dec 14 10:58:46 2017	(r456287)
@@ -58,6 +58,51 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
+    <topic>GitLab -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>gitlab</name>
+	<range><ge>4.2.0</ge><le>10.0.6</le></range>
+  <range><ge>10.1.0</ge><le>10.1.4</le></range>
+  <range><ge>10.2.0</ge><le>10.2.3</le></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>GitLab reports:</p>
+	<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
+    <h1>User without access to private Wiki can see it on the project page</h1>
+	  <p>Matthias Burtscher reported that it was possible for a user to see a
+	  private Wiki on the project page without having the corresponding
+	  permission.</p>
+    <h1>E-mail address disclosure through member search fields</h1>
+    <p>Hugo Geoffroy reported via HackerOne that it was possible to find out the
+    full e-mail address of any user by brute-forcing the member search
+    field.</p>
+    <h1>Groups API leaks private projects</h1>
+    <p>An internal code review discovered that users were able to list private
+    projects they had no access to by using the Groups API.</p>
+    <h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
+    <p>Sylvain Heiniger reported via HackerOne that it was possible for
+    arbitrary JavaScript code to be executed when editing a comment.</p>
+    <h1>Issue API allows any user to create a new issue even when issues are
+    restricted or disabled</h1>
+    <p>Mohammad Hasbini reported that any user could create a new issues in a
+    project even when issues were disabled or restricted to team members in the
+    project settings.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
+    </references>
+    <dates>
+      <discovery>2017-12-08</discovery>
+      <entry>2017-12-14</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
     <topic>tor -- Use-after-free in onion service v2</topic>
     <affects>
