[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add gitlab CVEs from gitlab advisory
Salvatore Bonaccorso
carnil at debian.org
Wed Jan 17 06:58:36 UTC 2018
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
80fb58c5 by Salvatore Bonaccorso at 2018-01-17T07:57:58+01:00
Add gitlab CVEs from gitlab advisory
Cf. https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -4579,8 +4579,10 @@ CVE-2018-3712
RESERVED
CVE-2018-3711
RESERVED
-CVE-2018-3710
+CVE-2018-3710 [Remote Code Execution Vulnerability in GitLab Projects Import]
RESERVED
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE-2017-17970 (Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote ...)
NOT-FOR-US: Muviko
CVE-2017-17969
@@ -62467,34 +62469,59 @@ CVE-2017-0929
RESERVED
CVE-2017-0928
RESERVED
-CVE-2017-0927
+CVE-2017-0927 [Guest Users Can Give Deploy Keys in Other Projects Write Access]
RESERVED
-CVE-2017-0926
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0926 [Login with Disabled OAuth Provider via POST]
RESERVED
-CVE-2017-0925
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0925 [Sensitive Fields Exposed to Admins / Masters in the Services API]
RESERVED
-CVE-2017-0924
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0924 [XSS in Label Dropdown]
RESERVED
-CVE-2017-0923
+ - gitlab <undetermined>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+ TODO: check, possibly not affecting Debian version since onlys starting from 9.0.0 according advisory
+CVE-2017-0923 [Jupyter Notebook XSS]
RESERVED
-CVE-2017-0922
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0922 [Milestone Authorization Issue on Boards]
RESERVED
+ - gitlab <undetermined>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+ NOTE: check, possibly not affecting Debian version since onlys starting from 9.1.0 according advisory
CVE-2017-0921
RESERVED
CVE-2017-0920
RESERVED
CVE-2017-0919
RESERVED
-CVE-2017-0918
+CVE-2017-0918 [GitLab CI Runner Can Read and Poison Cache of All Other Projects]
RESERVED
-CVE-2017-0917
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0917 [Cross-site scripting (XSS) vulnerability in CI job output]
RESERVED
-CVE-2017-0916
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0916 [Critical Vulnerability with Command Injection via Webhooks]
RESERVED
-CVE-2017-0915
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0915 [Remote Code Execution Vulnerability in GitLab Projects Import]
RESERVED
-CVE-2017-0914
+ - gitlab <unfixed>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+CVE-2017-0914 [Critical SQL Injection in MilestoneFinder]
RESERVED
+ - gitlab <undetermined>
+ NOTE: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+ TODO: check, possibly not affecting Debian version since onlys starting from 9.4.0 according advisory
CVE-2017-0913
RESERVED
CVE-2017-0912
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/80fb58c516cc2f0a42061f0cc07a2b25845d636b
---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/80fb58c516cc2f0a42061f0cc07a2b25845d636b
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180117/a0fe2d16/attachment.html>
More information about the Secure-testing-commits
mailing list