Gitlab — веб-платформа для управления проектами и репозиториями программного кода, работа которой основана на популярной системе контроля версий Git.
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 17.0.8 | 17.0.8 | ||
| 17.0.7 | 17.0.7 | ||
| 17.0.6 | 17.0.6 | ||
| 17.0.5 | 17.0.5 | ||
| 17.0.4 | 17.0.4 | ||
| 17.0.3 | 17.0.3 | ||
| 17.0.2 | 17.0.2 | ||
| 17.0.1 | 17.0.1 | ||
| 17.0.0 | 17.0.0 |
Показывать по
Количество 5 943
CVE-2021-39877
A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file.
CVE-2021-39874
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.
CVE-2021-39871
In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.
CVE-2021-39868
In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.
CVE-2021-39883
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups.
CVE-2021-39900
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.
CVE-2021-39873
In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.
CVE-2021-39899
In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.
BDU:2021-05738
Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольные команды
CVE-2021-22239
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2021-39877 A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file. | CVSS3: 7.7 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39874 In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. | CVSS3: 4.3 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39871 In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call. | CVSS3: 4.3 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39868 In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export. | CVSS3: 4.3 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39883 Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups. | CVSS3: 4.3 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39900 Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs. | CVSS3: 2 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39873 In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response. | CVSS3: 4.3 | 1% Низкий | почти 5 лет назад |
| CVE-2021-39899 In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations. | CVSS3: 2.9 | 0% Низкий | почти 5 лет назад |
 | BDU:2021-05738 Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольные команды | CVSS3: 10 | 100% Критический | почти 5 лет назад |
 | CVE-2021-22239 An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. | CVSS3: 5 | 1% Низкий | почти 5 лет назад |
Уязвимостей на страницу