Debian Gitlab vulnerabilities

CVE-2018-17451 [HIGH] CVE-2018-17451: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7... An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands. Scope: local sid: resolved (fixed in 11.1.8+dfsg-2)

CVE-2021-22170 [MEDIUM] CVE-2021-22170: gitlab - Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacke... Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-1733 [MEDIUM] CVE-2023-1733: gitlab - A denial of service condition exists in the Prometheus server bundled with GitLa... A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-15722 [HIGH] CVE-2019-15722: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.15 through ... An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2024-9633 [LOW] CVE-2024-9633: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks. Scope: local sid: resolve

CVE-2017-0922 [HIGH] CVE-2017-0922: gitlab - Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass ... Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object. Scope: local sid: resolved (fixed in 10.5.5+dfsg-1)

CVE-2022-3767 [HIGH] CVE-2022-3767: gitlab - Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to ... Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-4647 [MEDIUM] CVE-2023-4647: gitlab - An issue has been discovered in GitLab affecting all versions starting from 15.2... An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2020-10976 [HIGH] CVE-2020-10976: gitlab - GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a m... GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2024-8177 [MEDIUM] CVE-2024-8177: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 15.... An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2021-22209 [HIGH] CVE-2021-22209: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2024-8233 [HIGH] CVE-2024-8233: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 bef... An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2021-22234 [CRITICAL] CVE-2021-22234: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-3639 [MEDIUM] CVE-2022-3639: gitlab - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versi... A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-3917 [MEDIUM] CVE-2023-3917: gitlab - Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior ... Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2020-13315 [LOW] CVE-2020-13315: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service. Scope: local sid: resolved (fixed in 13.2.8-1)

CVE-2023-0632 [MEDIUM] CVE-2023-0632: gitlab - An issue has been discovered in GitLab affecting all versions starting from 15.2... An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2020-13306 [LOW] CVE-2020-13306: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation. Scope: local sid: resolved (fixed in 13.2.8-1)

CVE-2021-22190 [HIGH] CVE-2021-22190: gitlab - A path traversal vulnerability via the GitLab Workhorse in all versions of GitLa... A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-3385 [MEDIUM] CVE-2023-3385: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.10... An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`