Bitnami package
gitlab
pkg:bitnami/gitlab
Vulnerabilities (1,073)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-6680 | Hig | 7.4 | >= 11.6.0, < 16.4.4 | 16.4.4 | Dec 15, 2023 | An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authe | |
| CVE-2023-6051 | Med | 5.7 | < 16.4.4 | 16.4.4 | Dec 15, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific | |
| CVE-2023-5512 | Med | 4.8 | >= 16.3.0, < 16.4.4 | 16.4.4 | Dec 15, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading | |
| CVE-2023-5061 | Med | 4.3 | >= 9.3.0, < 16.4.4 | 16.4.4 | Dec 15, 2023 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI v | |
| CVE-2023-3904 | Med | 4.3 | < 16.4.4 | 16.4.4 | Dec 15, 2023 | An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issu | |
| CVE-2023-3511 | Low | 2.0 | >= 8.17.0, < 16.4.4 | 16.4.4 | Dec 15, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects | |
| CVE-2023-5332 | Med | 5.9 | >= 9.5.0, < 16.2.8 | 16.2.8 | Dec 4, 2023 | Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE. | |
| CVE-2023-6033 | Hig | 8.7 | >= 15.10.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser. | |
| CVE-2023-5995 | Med | 4.4 | >= 16.2.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal proj | |
| CVE-2023-5226 | Med | 4.8 | < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted bran | |
| CVE-2023-4912 | Low | 2.6 | >= 10.5.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using maliciou | |
| CVE-2023-4658 | Low | 3.1 | >= 8.13.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest u | |
| CVE-2023-4317 | Med | 4.3 | >= 9.2.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an un | |
| CVE-2023-3964 | Med | 4.3 | >= 13.2.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package | |
| CVE-2023-3949 | Med | 5.3 | >= 11.3.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via | |
| CVE-2023-3443 | Low | 3.1 | >= 12.1.0, < 16.4.3 | 16.4.3 | Dec 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items. | |
| CVE-2023-4379 | Hig | 8.1 | >= 15.3.0, < 16.2.8 | 16.2.8 | Nov 9, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated. | |
| CVE-2023-4700 | Low | 3.5 | >= 14.7.0, < 16.3.6 | 16.3.6 | Nov 6, 2023 | An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals. | |
| CVE-2023-5963 | Low | 3.1 | >= 13.9.0, < 16.3.6 | 16.3.6 | Nov 6, 2023 | An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators. | |
| CVE-2023-3909 | Med | 4.3 | >= 12.3.0, < 16.3.6 | 16.3.6 | Nov 6, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in time |
- affected >= 11.6.0, < 16.4.4fixed 16.4.4
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authe
- affected < 16.4.4fixed 16.4.4
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific
- affected >= 16.3.0, < 16.4.4fixed 16.4.4
An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading
- affected >= 9.3.0, < 16.4.4fixed 16.4.4
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI v
- affected < 16.4.4fixed 16.4.4
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issu
- affected >= 8.17.0, < 16.4.4fixed 16.4.4
An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects
- affected >= 9.5.0, < 16.2.8fixed 16.2.8
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
- affected >= 15.10.0, < 16.4.3fixed 16.4.3
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
- affected >= 16.2.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal proj
- affected < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted bran
- affected >= 10.5.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using maliciou
- affected >= 8.13.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest u
- affected >= 9.2.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an un
- affected >= 13.2.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package
- affected >= 11.3.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via
- affected >= 12.1.0, < 16.4.3fixed 16.4.3
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.
- affected >= 15.3.0, < 16.2.8fixed 16.2.8
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.
- affected >= 14.7.0, < 16.3.6fixed 16.3.6
An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals.
- affected >= 13.9.0, < 16.3.6fixed 16.3.6
An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.
- affected >= 12.3.0, < 16.3.6fixed 16.3.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in time
Page 23 of 54