Debian Gitlab vulnerabilities

CVE-2023-3904 [MEDIUM] CVE-2023-3904: gitlab - An issue has been discovered in GitLab EE affecting all versions starting before... An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Scope: local sid: resolved

CVE-2023-2233 [LOW] CVE-2023-2233: gitlab - An improper authorization issue has been discovered in GitLab CE/EE affecting al... An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-3511 [LOW] CVE-2023-3511: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 8... An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of. Scope: local sid: resolved

CVE-2023-3102 [MEDIUM] CVE-2023-3102: gitlab - A sensitive information leak issue has been discovered in GitLab EE affecting al... A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR. Scope: local sid: resolved

CVE-2023-1279 [LOW] CVE-2023-1279: gitlab - An issue has been discovered in GitLab affecting all versions starting from 4.1 ... An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-2589 [MEDIUM] CVE-2023-2589: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group. Scope: local sid: re

CVE-2023-1825 [LOW] CVE-2023-1825: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export. Scope: local sid: resolved

CVE-2023-0450 [LOW] CVE-2023-0450: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.1 ... An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-1084 [LOW] CVE-2023-1084: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.... An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-3993 [MEDIUM] CVE-2023-3993: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. Scope: local sid: resolved

CVE-2023-3115 [MEDIUM] CVE-2023-3115: gitlab - An issue has been discovered in GitLab EE affecting all versions affecting all v... An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories. Scope: local sid: resolved

CVE-2023-3950 [MEDIUM] CVE-2023-3950: gitlab - An information disclosure issue in GitLab EE affecting all versions from 16.2 pr... An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. Scope: local sid: resolved

CVE-2023-0508 [LOW] CVE-2023-0508: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-5963 [LOW] CVE-2023-5963: gitlab - An issue has been discovered in GitLab EE with Advanced Search affecting all ver... An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators. Scope: local sid: resolved

CVE-2023-5995 [MEDIUM] CVE-2023-5995: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects. Scope: local sid: resolved

CVE-2023-3907 [MEDIUM] CVE-2023-3907: gitlab - A privilege escalation vulnerability in GitLab EE affecting all versions from 16... A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner Scope: local sid: resolved

CVE-2023-3932 [HIGH] CVE-2023-3932: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. Scope: local sid: resolved

CVE-2023-3922 [LOW] CVE-2023-3922: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.15... An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-2182 [MEDIUM] CVE-2023-2182: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users. Scope: local sid: r

CVE-2023-4002 [MEDIUM] CVE-2023-4002: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's