[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add gitlab CVEs from gitlab advisory

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
80fb58c5 by Salvatore Bonaccorso at 2018-01-17T07:57:58+01:00
Add gitlab CVEs from gitlab advisory

Cf. https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -4579,8 +4579,10 @@ CVE-2018-3712
 	RESERVED
 CVE-2018-3711
 	RESERVED
-CVE-2018-3710
+CVE-2018-3710 [Remote Code Execution Vulnerability in GitLab Projects Import]
 	RESERVED
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
 CVE-2017-17970 (Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote ...)
 	NOT-FOR-US: Muviko
 CVE-2017-17969
@@ -62467,34 +62469,59 @@ CVE-2017-0929
 	RESERVED
 CVE-2017-0928
 	RESERVED
-CVE-2017-0927
+CVE-2017-0927 [Guest Users Can Give Deploy Keys in Other Projects Write Access]
 	RESERVED
-CVE-2017-0926
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0926 [Login with Disabled OAuth Provider via POST]
 	RESERVED
-CVE-2017-0925
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0925 [Sensitive Fields Exposed to Admins / Masters in the Services API]
 	RESERVED
-CVE-2017-0924
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0924 [XSS in Label Dropdown]
 	RESERVED
-CVE-2017-0923
+	- gitlab <undetermined>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+	TODO: check, possibly not affecting Debian version since onlys starting from 9.0.0 according advisory
+CVE-2017-0923 [Jupyter Notebook XSS]
 	RESERVED
-CVE-2017-0922
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0922 [Milestone Authorization Issue on Boards]
 	RESERVED
+	- gitlab <undetermined>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+	NOTE: check, possibly not affecting Debian version since onlys starting from 9.1.0 according advisory
 CVE-2017-0921
 	RESERVED
 CVE-2017-0920
 	RESERVED
 CVE-2017-0919
 	RESERVED
-CVE-2017-0918
+CVE-2017-0918 [GitLab CI Runner Can Read and Poison Cache of All Other Projects]
 	RESERVED
-CVE-2017-0917
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0917 [Cross-site scripting (XSS) vulnerability in CI job output]
 	RESERVED
-CVE-2017-0916
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0916 [Critical Vulnerability with Command Injection via Webhooks]
 	RESERVED
-CVE-2017-0915
+	 - gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0915 [Remote Code Execution Vulnerability in GitLab Projects Import]
 	RESERVED
-CVE-2017-0914
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0914 [Critical SQL Injection in MilestoneFinder]
 	RESERVED
+	- gitlab <undetermined>
+	NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+	TODO: check, possibly not affecting Debian version since onlys starting from 9.4.0 according advisory
 CVE-2017-0913
 	RESERVED
 CVE-2017-0912



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/80fb58c516cc2f0a42061f0cc07a2b25845d636b

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/80fb58c516cc2f0a42061f0cc07a2b25845d636b
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180117/a0fe2d16/attachment.html>