[Git][security-tracker-team/security-tracker][master] Track CVE fixed for gitlab after experimental -> unstable upload
Salvatore Bonaccorso
carnil at debian.org
Sat Nov 17 09:29:02 GMT 2018
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
70243d61 by Salvatore Bonaccorso at 2018-11-17T09:28:27Z
Track CVE fixed for gitlab after experimental -> unstable upload
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4655,13 +4655,13 @@ CVE-2018-17538 (** DISPUTED ** Axon (formerly TASER International) Evidence Sync
CVE-2018-17537 [Persistent XSS package.json]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 10.4 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17536 [Persistent XSS merge request project import]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 10.4 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17535
@@ -4865,41 +4865,41 @@ CVE-2018-17456 (Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2
CVE-2018-17455 [IDOR merge request approvals]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17454 [Persistent XSS on issue details]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 9.3 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17453 [GRPC::Unknown logging token disclosure]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 10.4 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17452 [validate_localhost function in url_blocker.rb could be bypassed]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17451 [Slack integration CSRF Oauth2]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 9.4 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17450 [SSRF GCP access token disclosure]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 10.2 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17449 [Confidential information disclosure in events API endpoint]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 9.3 and later)
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-17448 (An Incorrect Access Control issue was discovered in Citrix SD-WAN ...)
@@ -8054,24 +8054,24 @@ CVE-2018-16048 (An issue was discovered in GitLab Community and Enterprise Editi
NOTE: https://gitlab.com/gitlab-org/gitlab-ce/issues/49947
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-16051 (An issue was discovered in GitLab Community and Enterprise Edition ...)
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://gitlab.com/gitlab-org/gitlab-ee/issues/6012
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-XXXX [gitlab: Missing CSRF in System Hooks]
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-16049 (An issue was discovered in GitLab Community and Enterprise Edition ...)
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://gitlab.com/gitlab-org/gitlab-ce/issues/46967
NOTE: https://gitlab.com/gitlab-org/gitlab-ce/issues/49272
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-16050 (An issue was discovered in GitLab Community and Enterprise Edition ...)
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 11.1 and 11.2)
NOTE: https://gitlab.com/gitlab-org/gitlab-ce/issues/49085
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-XXXX [gitlab: Persistent XSS in Pipeline Tooltip]
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
[stretch] - gitlab <not-affected> (Only affects 10.7 and later)
NOTE: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE-2018-16158 (Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 ...)
@@ -9876,7 +9876,7 @@ CVE-2018-15474 (** DISPUTED ** CSV Injection (aka Excel Macro Injection or Formu
CVE-2018-15472 [Diff formatter DoS in Sidekiq jobs]
RESERVED
[experimental] - gitlab 11.1.8+dfsg-1
- - gitlab <unfixed>
+ - gitlab 11.1.8+dfsg-2
NOTE: https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE-2018-15467
RESERVED
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/70243d612d3055bbe68235bfad43b81d33e4a86f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/70243d612d3055bbe68235bfad43b81d33e4a86f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181117/0256d2ca/attachment.html>
More information about the debian-security-tracker-commits
mailing list