apk package
chainguard/gitlab-workhorse-ce-fips-18.1
pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.1
Vulnerabilities (50)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-8014 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 27, 2025 | Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service dis | ||
| CVE-2025-11042 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using speci | ||
| CVE-2025-5069 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name t | ||
| CVE-2025-10868 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs. | ||
| CVE-2025-7691 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain un | ||
| CVE-2025-9642 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover. | ||
| CVE-2025-9958 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations. | ||
| CVE-2025-10858 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files. | ||
| CVE-2025-10867 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated | ||
| CVE-2025-10871 | — | < 18.1.6-r4 | 18.1.6-r4 | Sep 26, 2025 | An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively gran |
- CVE-2025-8014Sep 27, 2025affected < 18.1.6-r4fixed 18.1.6-r4
Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service dis
- CVE-2025-11042Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using speci
- CVE-2025-5069Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name t
- CVE-2025-10868Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.
- CVE-2025-7691Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain un
- CVE-2025-9642Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.
- CVE-2025-9958Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.
- CVE-2025-10858Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.
- CVE-2025-10867Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated
- CVE-2025-10871Sep 26, 2025affected < 18.1.6-r4fixed 18.1.6-r4
An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively gran
Page 3 of 3