From owner-svn-ports-head@freebsd.org Thu Jul 20 08:45:12 2017 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 29717DAC68A; Thu, 20 Jul 2017 08:45:12 +0000 (UTC) (envelope-from tz@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 035AC2AF4; Thu, 20 Jul 2017 08:45:11 +0000 (UTC) (envelope-from tz@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v6K8jBQa025022; Thu, 20 Jul 2017 08:45:11 GMT (envelope-from tz@FreeBSD.org) Received: (from tz@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v6K8jBUI025020; Thu, 20 Jul 2017 08:45:11 GMT (envelope-from tz@FreeBSD.org) Message-Id: <201707200845.v6K8jBUI025020@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tz set sender to tz@FreeBSD.org using -f From: Torsten Zuehlsdorff Date: Thu, 20 Jul 2017 08:45:11 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r446244 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: tz X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 446244 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jul 2017 08:45:12 -0000 Author: tz Date: Thu Jul 20 08:45:10 2017 New Revision: 446244 URL: https://svnweb.freebsd.org/changeset/ports/446244 Log: Document GitLab vulnerabilities Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Jul 20 04:15:24 2017 (r446243) +++ head/security/vuxml/vuln.xml Thu Jul 20 08:45:10 2017 (r446244) @@ -58,6 +58,77 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + GitLab -- Various security issues + + + gitlab + 8.0.08.17.6 + 9.0.09.0.10 + 9.1.09.1.7 + 9.2.09.2.7 + 9.3.09.4.7 + + + + +

GitLab reports:

+
Projects in subgroups authorization bypass with SQL wildcards + (CVE-2017-11438)
+
An internal code review disclosed that by choosing a namespace with + underscores an authenticated user could take advantage of a badly written + SQL query to add themselves to any project inside a subgroup with + permissions of their choice.
+ This vulnerability was caused by a SQL query that automatically adjusts + project permissions but does not escape wildcards. This vulnerability was + coincidentally patched when the affected code was rewritten for + 9.3. Therefore, versions 9.3 and above are not vulnerable.
+
+ This issue has been assigned CVE-2017-11438.
+
+ Note: GitLab-CE+EE 8.17 is not vulnerable to this issue, however patches + have been included to improve the security of the SQL queries in 8.17.7.
+
Symlink cleanup from a previous security release
+
The 9.2.5 security release contained a fix for a data corruption + vulnerability involving file uploads. This fix utilized symlinks to migrate + file uploads to a new directory. Due to a typo in the included migration a + symlink was accidentally left behind after the migration finished. This + symlink can cause problems with instance backups. A fix is included with + these releases to remove the problematic symlink.
+
Accidental or malicious use of reserved names in group names could cause + deletion of all snippet uploads
+
The 9.2.5 security release contained a fix for a data corruption + vulnerability involving file uploads. After the release of 9.2.5 an internal + code review determined that the recently introduced snippet file uploads + feature was also vulnerable to file deletion. Snippet uploads have now been + moved into the protected system namespace.
+
Project name leak on todos page
+
An internal code review discovered that forceful browsing could be + utilized to disclose the names of private projects.
+
Denial of Service via regular expressions in CI process
+
Lukas Svoboda reported that regular expressions (regex) included with CI + scripts could be utilized to perform a denial-of-service attack on GitLab + instances. GitLab now uses the re2 Regex library to limit regex execution + time.
+
Issue title leakage when external issue tracker is enabled
+
An internal code review determined that when an external issue tracker is + configured it was possible to discover the titles of all issues in a given + GitLab instance, including issues in private projects and confidential + issues.
+

+ + + + https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/ + CVE-2017-11438 + + + 2017-07-20 + 2017-07-20 + + + MySQL -- multiple vulnerabilities