Debian Gitlab vulnerabilities

CVE-2017-0882 [MEDIUM] CVE-2017-0882: gitlab - Multiple versions of GitLab expose sensitive user credentials when assigning a u... Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC. Scope: local sid: resolved (fixed in 8.13.11+dfsg-7)

CVE-2025-1072 [MEDIUM] CVE-2025-1072: gitlab - A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting al... A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2024-6826 [MEDIUM] CVE-2024-6826: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 be... An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Scope: local sid: resolved (fixed in 17.5.5-2)

CVE-2024-5423 [MEDIUM] CVE-2024-5423: gitlab - Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE ... Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2024-8041 [MEDIUM] CVE-2024-8041: gitlab - A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting al... A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2018-20501 [MEDIUM] CVE-2018-20501: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.4.1... An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Scope: local sid: resolved (fixed in 11.5.6+dfsg-1)

CVE-2022-3279 [LOW] CVE-2022-3279: gitlab - An unhandled exception in job log parsing in GitLab CE/EE affecting all versions... An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2024-3958 [MEDIUM] CVE-2024-3958: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.... An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2022-4206 [MEDIUM] CVE-2022-4206: gitlab - A sensitive information leak issue has been discovered in all versions of DAST A... A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1120 [MEDIUM] CVE-2022-1120: gitlab - Missing filtering in an error message in GitLab CE/EE affecting all versions pri... Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13325 [HIGH] CVE-2020-13325: gitlab - A vulnerability was discovered in GitLab versions prior 13.1. The comment sectio... A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2020-13281 [MEDIUM] CVE-2020-13281: gitlab - For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the proj... For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2019-15584 [MEDIUM] CVE-2019-15584: gitlab - A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that woul... A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2018-18640 [MEDIUM] CVE-2018-18640: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7... An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching. Scope: local sid: resolved (fixed in 11.2.8+dfsg-2)

CVE-2018-17976 [MEDIUM] CVE-2018-17976: gitlab - An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x b... An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions. Scope: local sid: resolved (fixed in 11.1.8+dfsg-2)

CVE-2023-3909 [MEDIUM] CVE-2023-3909: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-6678 [MEDIUM] CVE-2023-6678: gitlab - An issue has been discovered in GitLab EE affecting all versions before 16.8.6, ... An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2023-6502 [MEDIUM] CVE-2023-6502: gitlab - A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affectin... A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2023-5825 [MEDIUM] CVE-2023-5825: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of

CVE-2020-13297 [LOW] CVE-2020-13297: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. Scope: local sid: resolved (fixed in 13.2.8-1)