PT-2017-12551 · Gitlab · Gitlab Ce/Ee+1

Publicado 2017-08-14 · Atualizado 2017-08-25 · CVE-2017-12426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 8.17.8 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.0.x through 9.0.12 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.1.x through 9.1.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.2.x through 9.2.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.3.x through 9.3.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.4.x through 9.4.3

Description The issue might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.

Recommendations For versions prior to 8.17.8, update to version 8.17.8 or later. For versions 9.0.x through 9.0.12, update to version 9.0.13 or later. For versions 9.1.x through 9.1.9, update to version 9.1.10 or later. For versions 9.2.x through 9.2.9, update to version 9.2.10 or later. For versions 9.3.x through 9.3.9, update to version 9.3.10 or later. For versions 9.4.x through 9.4.3, update to version 9.4.4 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-12426

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 11

• https://ubuntu.com/security/CVE-2017-12426 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12426 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12426 · Nota de Segurança
• https://about.gitlab.com/releases/2017/08/10/gitlab-9-dot-4-dot-4-released · Nota
• https://mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html · Nota
• https://gitlab.com/gitlab-org/gitlab-ce/issues/35212 · Nota
• https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12426 · Nota de Segurança
• https://mail-archive.com/[e-mail]/msg1466490.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12426 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12426 · Aviso do Fabricante