Debian Gitlab vulnerabilities

CVE-2020-13356 [HIGH] CVE-2020-13356: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, =13.4, =13.5, <13.5.2. Scope: local sid: resolved (fixed in 13.3.9-1)

CVE-2020-10980 [CRITICAL] CVE-2020-10980: gitlab - GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integr... GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2019-9485 [CRITICAL] CVE-2019-9485: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.6.1... An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. Scope: local sid: resolved (fixed in 11.8.2-2)

CVE-2023-4008 [MEDIUM] CVE-2023-4008: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known. Scope: local sid: resolved (fixed in 16.0.8+ds1-1)

CVE-2024-4901 [HIGH] CVE-2024-4901: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.... An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2017-0926 [HIGH] CVE-2017-0926: gitlab - Gitlab Community Edition version 10.3 is vulnerable to an improper authorization... Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. Scope: local sid: resolved (fixed in 10.5.5+dfsg-1)

CVE-2019-15589 [HIGH] CVE-2019-15589: gitlab - An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v... An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2024-8754 [MEDIUM] CVE-2024-8754: gitlab - An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 ... An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured. Scope: local sid: resolved (fixed in 17.3.5-3)

CVE-2021-39937 [MEDIUM] CVE-2021-39937: gitlab - A collision in access memoization logic in all versions of GitLab CE/EE before 1... A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13355 [HIGH] CVE-2020-13355: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, =13.4, =13.5, <13.5.2. Scope: local sid: resolved (fixed in 13.3.9-1)

CVE-2020-13343 [HIGH] CVE-2020-13343: gitlab - An issue has been discovered in GitLab affecting all versions starting from 11.2... An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template Scope: local sid: resolved (fixed in 13.2.10-1)

CVE-2019-9218 [CRITICAL] CVE-2019-9218: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.6.1... An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5). Scope: local sid: resolved (fixed in 11.8.2-2)

CVE-2022-0427 [HIGH] CVE-2022-0427: gitlab - Missing sanitization of HTML attributes in Jupyter notebooks in all versions of ... Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-9217 [CRITICAL] CVE-2019-9217: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.6.1... An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information. Scope: local sid: resolved (fixed in 11.8.2-2)

CVE-2019-12443 [CRITICAL] CVE-2019-12443: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.2 through ... An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2022-2826 [LOW] CVE-2022-2826: gitlab - An issue has been discovered in GitLab affecting all versions starting from 10.0... An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. TODO Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13292 [CRITICAL] CVE-2020-13292: gitlab - In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail ver... In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2020-13312 [MEDIUM] CVE-2020-13312: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter. Scope: local sid: resolved (fixed in 13.2.8-1)

CVE-2024-11274 [HIGH] CVE-2024-11274: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.... An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2019-5464 [CRITICAL] CVE-2019-5464: gitlab - A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and ... A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized. Scope: local sid: resolved (fixed in 12.6.8-3)