Debian Gitlab vulnerabilities

CVE-2016-9086 [MEDIUM] CVE-2016-9086: gitlab - GitLab versions 8.9.x and above contain a critical security flaw in the "import/... GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was mad

CVE-2020-13299 [HIGH] CVE-2020-13299: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session. Scope: local sid: resolved (fixed in 13.2.8-1)

CVE-2021-22167 [MEDIUM] CVE-2021-22167: gitlab - An issue has been discovered in GitLab affecting all versions starting from 12.1... An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-6240 [HIGH] CVE-2019-6240: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.4. ... An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. Scope: local sid: resolved (fixed in 11.5.7+dfsg-1)

CVE-2019-15729 [HIGH] CVE-2019-15729: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.18 through ... An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2022-0136 [MEDIUM] CVE-2022-0136: gitlab - A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4... A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-5470 [HIGH] CVE-2019-5470: gitlab - An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.... An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2019-15728 [HIGH] CVE-2019-15728: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.1 through ... An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2022-3285 [MEDIUM] CVE-2022-3285: gitlab - Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior... Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2019-18460 [HIGH] CVE-2019-18460: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.15 through ... An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2022-1510 [MEDIUM] CVE-2022-1510: gitlab - An issue has been discovered in GitLab affecting all versions starting from 13.9... An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption. Scope: local sid

CVE-2021-22228 [MEDIUM] CVE-2021-22228: gitlab - An issue has been discovered in GitLab affecting all versions before 13.11.6, al... An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13304 [LOW] CVE-2020-13304: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.... A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions. Scope: local sid: resolved (fixed in 13.2.8-1)

CVE-2019-18457 [HIGH] CVE-2019-18457: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 11.8 through ... An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2020-13334 [MEDIUM] CVE-2020-13334: gitlab - In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization c... In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query Scope: local sid: resolved (fixed in 13.2.10-1)

CVE-2022-3031 [LOW] CVE-2022-3031: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.... An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account. Scope: l

CVE-2019-6782 [HIGH] CVE-2019-6782: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8... An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 1 of 6). An authorization issue allows the contributed project information of a private profile to be viewed. Scope: local sid: resolved (fixed in 11.5.10+dfsg-1)

CVE-2022-3283 [HIGH] CVE-2022-3283: gitlab - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versi... A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage. Scope: local sid: resolved (fixed in 15.10.8+ds

CVE-2018-20494 [HIGH] CVE-2018-20494: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.4.1... An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Scope: local sid: resolved (fixed in 11.5.6+dfsg-1)

CVE-2019-15730 [HIGH] CVE-2019-15730: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.14 through ... An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server. Scope: local sid: resolved (fixed