Date: Fri, 26 Jan 2024 09:42:01 GMT From: Matthias Fechner <mfechner@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 708f3b2e6d15 - main - security/vuxml: document gitlab vulnerabilities Message-ID: <202401260942.40Q9g1sC036851@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by mfechner: URL: https://cgit.FreeBSD.org/ports/commit/?id=708f3b2e6d1504d6d0ff999e4d1a875ec129ad34 commit 708f3b2e6d1504d6d0ff999e4d1a875ec129ad34 Author: Matthias Fechner <mfechner@FreeBSD.org> AuthorDate: 2024-01-26 09:41:32 +0000 Commit: Matthias Fechner <mfechner@FreeBSD.org> CommitDate: 2024-01-26 09:41:32 +0000 security/vuxml: document gitlab vulnerabilities --- security/vuxml/vuln/2024.xml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 10cec0fd7dc3..a407178cf534 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,40 @@ + <vuln vid="61fe903b-bc2e-11ee-b06e-001b217b3468"> + <topic>Gitlab -- vulnerabilities</topic> + <affects> + <package> + <name>gitlab-ce</name> + <range><ge>16.8.0</ge><lt>16.8.1</lt></range> + <range><ge>16.7.0</ge><lt>16.7.4</lt></range> + <range><ge>16.6.0</ge><lt>16.6.6</lt></range> + <range><ge>12.7.0</ge><lt>16.5.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Gitlab reports:</p> + <blockquote cite="https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/">; + <p>Arbitrary file write while creating workspace</p> + <p>ReDoS in Cargo.toml blob viewer</p> + <p>Arbitrary API PUT requests via HTML injection in user's name</p> + <p>Disclosure of the public email in Tags RSS Feed</p> + <p>Non-Member can update MR Assignees of owned MRs</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-0402</cvename> + <cvename>CVE-2023-6159</cvename> + <cvename>CVE-2023-5933</cvename> + <cvename>CVE-2023-5612</cvename> + <cvename>CVE-2024-0456</cvename> + <url>https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/</url>; + </references> + <dates> + <discovery>2024-01-25</discovery> + <entry>2024-01-26</entry> + </dates> + </vuln> + <vuln vid="8b03d274-56ca-489e-821a-cf32f07643f0"> <topic>jenkins -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202401260942.40Q9g1sC036851>