PT-2019-11575 · Gitlab · Gitlab Ce/Ee+1

Douglas Barbosa Alexandre · Publicado 2019-05-16 · Atualizado 2021-07-21 · CVE-2019-10112

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 GitLab Community and Enterprise Edition versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4

Description: The issue concerns the insecure derivation of the HMAC key construction in GitLab.

Recommendations: For versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2, update to version 11.7.8, 11.8.4, or 11.9.2, respectively. For versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4, update to version 11.7.10, 11.8.6, or 11.9.4, respectively.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2019-10112

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 5

• 🔥 https://gitlab.com/gitlab-org/gitlab-ee/issues/9730 · Exploit
• https://about.gitlab.com/blog/categories/releases · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10112 · Aviso do Fabricante
• https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10112 · Nota de Segurança