[Git][security-tracker-team/security-tracker][master] Track some fixes for CVEs for gitlab (was uploaded source wise to unstable)
Salvatore Bonaccorso
carnil at debian.org
Tue Aug 11 21:06:03 BST 2020
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3aa6edee by Salvatore Bonaccorso at 2020-08-11T22:05:28+02:00
Track some fixes for CVEs for gitlab (was uploaded source wise to unstable)
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -9878,15 +9878,15 @@ CVE-2020-13295 (For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing d
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13294 (In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not re ...)
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13293 (In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexa ...)
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13292 (In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass ...)
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13291
RESERVED
@@ -9895,7 +9895,7 @@ CVE-2020-13291
CVE-2020-13290
RESERVED
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13289
RESERVED
@@ -9918,22 +9918,22 @@ CVE-2020-13284
CVE-2020-13283
RESERVED
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13282
RESERVED
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13281
RESERVED
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13280
RESERVED
[experimental] - gitlab 13.1.6-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/08/05/gitlab-13-2-3-released/
CVE-2020-13279 (Client side code execution in gitlab-vscode-extension v2.2.0 allows at ...)
NOT-FOR-US: gitlab-vscode-extension
@@ -12486,15 +12486,15 @@ CVE-2020-12278 (An issue was discovered in libgit2 before 0.28.4 and 0.9x before
NOTE: https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb
CVE-2020-12277 (GitLab 10.8 through 12.9 has a vulnerability that allows someone to mi ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-12276 (GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin noti ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-12275 (GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-12274 (In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url param ...)
NOT-FOR-US: TestLink
@@ -14938,7 +14938,7 @@ CVE-2020-11650 (An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2
NOT-FOR-US: FreeNAS
CVE-2020-11649 (An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Membe ...)
[experimental] - gitlab 12.9.3+dfsg-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
CVE-2020-11648
RESERVED
@@ -15598,7 +15598,7 @@ CVE-2020-11507 (An Untrusted Search Path vulnerability in Malwarebytes AdwCleane
NOT-FOR-US: Malwarebytes AdwCleaner
CVE-2020-11506 (An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A W ...)
[experimental] - gitlab 12.9.3+dfsg-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
CVE-2020-11505 (An issue was discovered in GitLab Community Edition (CE) and Enterpris ...)
- gitlab <not-affected> (Only affects GitLab EE 12.8.0 and later)
@@ -16946,31 +16946,31 @@ CVE-2020-10982 (Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.p
NOT-FOR-US: Gambio GX
CVE-2020-10981 (GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintaine ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10980 (GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogB ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10979 (GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pip ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10978 (GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10977 (GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when mov ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10976 (GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when qu ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10975 (GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerab ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10974 (An issue was discovered on Wavlink WL-WN579G3 - M79X3.V5030.180719 and ...)
NOT-FOR-US: Wavlink
@@ -17044,22 +17044,22 @@ CVE-2020-10957 (In Dovecot before 2.3.10.1, unauthenticated sending of malformed
NOTE: https://www.openwall.com/lists/oss-security/2020/05/18/1
CVE-2020-10956 (GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a proje ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10955 (GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10954 (GitLab through 12.9 is affected by a potential DoS in repository archi ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10953 (In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a pat ...)
- gitlab <not-affected> (Only affects GitLab EE 11.7 and later)
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10952 (GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push doc ...)
[experimental] - gitlab 12.8.8-1
- - gitlab <unfixed>
+ - gitlab 13.2.3-2
NOTE: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE-2020-10951 (Western Digital My Cloud Home and ibi devices before 2.2.0 allow click ...)
NOT-FOR-US: Western Digital My Cloud Home and ibi devices
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3aa6edee32b4076eaa241c02b2d53288520e0b78
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3aa6edee32b4076eaa241c02b2d53288520e0b78
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200811/f3909d56/attachment.html>
More information about the debian-security-tracker-commits
mailing list