chainguard/gitlab-rails-ee-fips-17.1

Vulnerabilities (29)

• CVE-2024-45409Sep 10, 2024
  affected < 17.1.8-r0fixed 17.1.8-r0

  The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forg

• CVE-2024-34158HigSep 6, 2024
  affected < 17.1.6-r1fixed 17.1.6-r1

  Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

• CVE-2024-34156HigSep 6, 2024
  affected < 17.1.6-r1fixed 17.1.6-r1

  Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

• CVE-2024-34155MedSep 6, 2024
  affected < 17.1.6-r1fixed 17.1.6-r1

  Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

• CVE-2024-24791HigJul 2, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the co

• CVE-2024-24789Jun 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip pac

• CVE-2024-24790Jun 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

• CVE-2024-36361MedMay 24, 2024
  affected < 0fixed 0

  Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and t

• CVE-2024-24787MedMay 8, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

• CVE-2024-24785MedMar 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

• CVE-2024-24784HigMar 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

• CVE-2024-24783MedMar 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The defaul

• CVE-2023-45290MedMar 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line

• CVE-2023-45289MedMar 5, 2024
  affected < 17.1.3-r0fixed 17.1.3-r0

  When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorizati

• CVE-2021-23383May 4, 2021
  affected < 0fixed 0

  The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

• CVE-2021-23369Apr 12, 2021
  affected < 0fixed 0

  The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

• CVE-2021-21353Mar 3, 2021
  affected < 0fixed 0

  Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug temp

• CVE-2020-7788Dec 11, 2020
  affected < 0fixed 0

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

• CVE-2019-20920Sep 30, 2020
  affected < 0fixed 0

  Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing

• CVE-2020-7712Aug 30, 2020
  affected < 0fixed 0

  This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.