diff options
| author | Torsten Zuehlsdorff <tz@FreeBSD.org> | 2017-05-18 10:58:06 +0000 |
|---|---|---|
| committer | Torsten Zuehlsdorff <tz@FreeBSD.org> | 2017-05-18 10:58:06 +0000 |
| commit | 707e59a538692fc55f2311b7bf448920c3655257 (patch) | |
| tree | f32000c50436db2cec307d70383e64ae9b41be52 /security/vuxml | |
| parent | b43a636a516f80cf3a76e9199987b30b2504fe18 (diff) | |
| download | ports-707e59a538692fc55f2311b7bf448920c3655257.tar.gz ports-707e59a538692fc55f2311b7bf448920c3655257.zip | |
Document recent GitLab vulnerabilities.
Notes
Notes:
svn path=/head/; revision=441143
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 98b4800586c9..43453ae0b662 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b"> + <topic>gitlab -- Various security issues</topic> + <affects> + <package> + <name>gitlab</name> + <range><ge>6.6.0</ge><le>8.17.5</le></range> + <range><ge>9.0.0</ge><le>9.0.6</le></range> + <range><ge>9.1.0</ge><le>9.1.2</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>GitLab reports:</p> + <blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/"> + <h1>Cross-Site Scripting (XSS) vulnerability in project import file names for gitlab_project import types</h1> + <p>Timo Schmid from ERNW reported a persistent Cross-Site Scripting vulnerability in the new project import view for gitlab_project import types. This XSS vulnerability was caused by the use of Hamlit filters inside HAML views without manually escaping HTML. Unlike content outside of a filter, content inside Hamlit filters (:css, :javascript, :preserve, :plain) is not automatically escaped.</p> + <h1>Cross-Site Scripting (XSS) vulnerability in git submodule support</h1> + <p>Jobert Abma from HackerOne reported a persitent XSS vulnerability in the GitLab repository files view that could be exploited by injecting malicious script into a git submodule.</p> + <h1>Cross-Site Scripting (XSS) vulnerability in repository "new branch" view</h1> + <p>A GitLab user reported a persistent XSS vulnerability in the repository new branch view that allowed malicious branch names or git references to execute arbitrary Javascript.</p> + <h1>Cross-Site Scripting (XSS) vulnerability in mirror errors display</h1> + <p>While investigating Timo Schmid's previously reported XSS vulnerability in import filenames another persistent XSS vulnerability was discovered in the GitLab Enterprise Edition's (EE) mirror view. This vulnerability was also caused by the misuse of Hamlit filters.</p> + <h1>Potential XSS vulnerability in DropLab</h1> + <p>An internal code audit disclosed a vulnerability in DropLab's templating that, while not currently exploitable, could become exploitable depending on how the templates were used in the future.</p> + <h1>Tab Nabbing vulnerabilities in mardown link filter, Asciidoc files, and other markup files</h1> + <p>edio via HackerOne reported two tab nabbing vulnerabilities. The first tab nabbing vulnerability was caused by improper hostname filtering when identifying user-supplied external links. GitLab did not properly filter usernames from the URL. An attacker could construct a specially crafted link including a username to bypass GitLab's external link filter. This allowed an attacker to post links in Markdown that did not include the appropriate "noreferrer noopener" options, allowing tab nabbing attacks.</p> + <p>The second vulnerability was in the AsciiDoctor markup library. AsciiDoctor was not properly including the "noreferrer noopener" options with external links. An internal investigation discovered other markup libraries that were also vulnerable.</p> + <h1>Unauthorized disclosure of wiki pages in search</h1> + <p>M. Hasbini reported a flaw in the project search feature that allowed authenticated users to disclose the contents of private wiki pages inside public projects.</p> + <h1>External users can view internal snippets</h1> + <p>Christian Kühn discovered a vulnerability in GitLab snippets that allowed an external user to view the contents of internal snippets.</p> + <h1>Subgroup visibility for private subgroups under a public parent group</h1> + <p>Matt Harrison discovered a vulnerability with subgroups that allowed private subgroup names to be disclosed when they belong to a parent group that is public.</p> + </blockquote> + </body> + </description> + <references> + <url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url> + </references> + <dates> + <discovery>2017-05-08</discovery> + <entry>2017-05-18</entry> + </dates> + </vuln> + <vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b"> <topic>gitlab -- Various security issues</topic> <affects> |