From owner-svn-ports-all@freebsd.org Fri Aug 11 08:05:11 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 69D47DC9EA3; Fri, 11 Aug 2017 08:05:11 +0000 (UTC) (envelope-from tz@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 41BF465B91; Fri, 11 Aug 2017 08:05:11 +0000 (UTC) (envelope-from tz@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v7B85AKr065849; Fri, 11 Aug 2017 08:05:10 GMT (envelope-from tz@FreeBSD.org) Received: (from tz@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v7B85AuV065847; Fri, 11 Aug 2017 08:05:10 GMT (envelope-from tz@FreeBSD.org) Message-Id: <201708110805.v7B85AuV065847@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tz set sender to tz@FreeBSD.org using -f From: Torsten Zuehlsdorff Date: Fri, 11 Aug 2017 08:05:10 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r447739 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: tz X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 447739 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Aug 2017 08:05:11 -0000 Author: tz Date: Fri Aug 11 08:05:09 2017 New Revision: 447739 URL: https://svnweb.freebsd.org/changeset/ports/447739 Log: Document GitLab vulnerabilities Security: CVE-2017-12426 Security: https://vuxml.FreeBSD.org/freebsd/abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Aug 11 07:58:52 2017 (r447738) +++ head/security/vuxml/vuln.xml Fri Aug 11 08:05:09 2017 (r447739) @@ -58,6 +58,62 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + GitLab -- two vulnerabilities + + + gitlab + 7.9.08.17.8 + 9.0.09.0.12 + 9.1.09.1.9 + 9.2.09.2.9 + 9.3.09.3.9 + 9.4.09.4.3 + + + + +

GitLab reports:

+
Remote Command Execution in git client
+
An external code review performed by Recurity-Labs identified a remote + command execution vulnerability in git that could be exploited via the "Repo + by URL" import option in GitLab. The command line git client was not + properly escaping command line arguments in URLs using the SSH protocol + before invoking the SSH client. A specially crafted URL could be used to + execute arbitrary shell commands on the GitLab server.
+ To fully patch this vulnerability two fixes were needed. The Omnibus + versions of GitLab contain a patched git client. For source users who may + still be running an older version of git, GitLab now also blocks import URLs + containing invalid host and usernames.
+ This issue has been assigned CVE-2017-12426.
+
Improper sanitization of GitLab export files on import
+
GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a + patch for a critical directory traversal vulnerability in the GitLab export + feature that could be exploited by including symlinks in the export file and + then re-importing it to a GitLab instance. This vulnerability was patched by + checking for and removing symlinks in these files on import.
+ Recurity-Labs also determined that this fix did not properly remove symlinks for + hidden files. Though not as dangerous as the original vulnerability hidden file + symlinks could still be used to steal copies of git repositories belonging to + other users if the path to the git repository was known by the attacker. An + updated fix has been included in these releases that properly removes all + symlinks.
+ This import option was not made available to non-admin users until GitLab + 8.13.0.
+

+ + + + https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/ + CVE-2017-12426 + + + 2017-08-10 + 2017-08-11 + + + PostgreSQL vulnerabilities