Date: Thu, 14 Dec 2017 10:58:47 +0000 (UTC) From: Torsten Zuehlsdorff <tz@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r456287 - head/security/vuxml Message-ID: <201712141058.vBEAwlRZ019776@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tz Date: Thu Dec 14 10:58:46 2017 New Revision: 456287 URL: https://svnweb.freebsd.org/changeset/ports/456287 Log: Document GitLab Vulnerability Security: https://vuxml.FreeBSD.org/freebsd/e72a8864-e0bc-11e7-b627-d43d7e971a1b.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Dec 14 10:07:04 2017 (r456286) +++ head/security/vuxml/vuln.xml Thu Dec 14 10:58:46 2017 (r456287) @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b"> + <topic>GitLab -- multiple vulnerabilities</topic> + <affects> + <package> + <name>gitlab</name> + <range><ge>4.2.0</ge><le>10.0.6</le></range> + <range><ge>10.1.0</ge><le>10.1.4</le></range> + <range><ge>10.2.0</ge><le>10.2.3</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>GitLab reports:</p> + <blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">; + <h1>User without access to private Wiki can see it on the project page</h1> + <p>Matthias Burtscher reported that it was possible for a user to see a + private Wiki on the project page without having the corresponding + permission.</p> + <h1>E-mail address disclosure through member search fields</h1> + <p>Hugo Geoffroy reported via HackerOne that it was possible to find out the + full e-mail address of any user by brute-forcing the member search + field.</p> + <h1>Groups API leaks private projects</h1> + <p>An internal code review discovered that users were able to list private + projects they had no access to by using the Groups API.</p> + <h1>Cross-Site Scripting (XSS) possible by editing a comment</h1> + <p>Sylvain Heiniger reported via HackerOne that it was possible for + arbitrary JavaScript code to be executed when editing a comment.</p> + <h1>Issue API allows any user to create a new issue even when issues are + restricted or disabled</h1> + <p>Mohammad Hasbini reported that any user could create a new issues in a + project even when issues were disabled or restricted to team members in the + project settings.</p> + </blockquote> + </body> + </description> + <references> + <url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>; + </references> + <dates> + <discovery>2017-12-08</discovery> + <entry>2017-12-14</entry> + </dates> + </vuln> + <vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2"> <topic>tor -- Use-after-free in onion service v2</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201712141058.vBEAwlRZ019776>