Debian Gitlab vulnerabilities

CVE-2022-2908 [MEDIUM] CVE-2022-2908: gitlab - A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting f... A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1193 [MEDIUM] CVE-2022-1193: gitlab - Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prio... Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39874 [MEDIUM] CVE-2021-39874: gitlab - In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2... In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39934 [MEDIUM] CVE-2021-39934: gitlab - Improper access control allows any project member to retrieve the service desk e... Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39870 [MEDIUM] CVE-2021-39870: gitlab - In all versions of GitLab CE/EE since version 11.11, an instance that has the se... In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-0373 [MEDIUM] CVE-2022-0373: gitlab - Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4,... Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-22247 [MEDIUM] CVE-2021-22247: gitlab - Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows ... Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39871 [MEDIUM] CVE-2021-39871: gitlab - In all versions of GitLab CE/EE since version 13.0, an instance that has the set... In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2630 [MEDIUM] CVE-2022-2630: gitlab - An improper access control issue in GitLab CE/EE affecting all versions starting... An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1124 [MEDIUM] CVE-2022-1124: gitlab - An improper authorization issue has been discovered in GitLab CE/EE affecting al... An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-22180 [MEDIUM] CVE-2021-22180: gitlab - An issue has been discovered in GitLab affecting all versions starting from 13.4... An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-3030 [MEDIUM] CVE-2022-3030: gitlab - An improper access control issue in GitLab CE/EE affecting all versions starting... An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2244 [MEDIUM] CVE-2022-2244: gitlab - An improper authorization vulnerability in GitLab EE/CE affecting all versions f... An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-6997 [MEDIUM] CVE-2019-6997: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.x (startin... An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles. Scope: local sid: resolved (fixed in 11.5.10+dfsg-1)

CVE-2019-12431 [MEDIUM] CVE-2019-12431: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.13 through ... An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2023-1204 [MEDIUM] CVE-2023-1204: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings. Scope: local sid: resolved (fix

CVE-2022-4289 [MEDIUM] CVE-2022-4289: gitlab - An issue has been discovered in GitLab affecting all versions starting from 15.3... An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2417 [MEDIUM] CVE-2022-2417: gitlab - Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior ... Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the pro

CVE-2023-0450 [LOW] CVE-2023-0450: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.1 ... An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39927 [LOW] CVE-2021-39927: gitlab - Server side request forgery protections in GitLab CE/EE versions between 8.4 and... Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443 Scope: local sid: resolved (fixed in 15.10.8+ds1-2)