Maxim Ivanov

**Name of the Vulnerable Software and Affected Versions** GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 **Description** The issue concerns incorrect access control, allowing unauthorized users to access the contents of an LFS object if the file size and OID are known. **Recommendations** For GitLab Community and Enterprise Edition versions 11.5.8 and earlier, update to version 11.5.8 or later. For GitLab Community and Enterprise Edition versions 11.6.x before 11.6.6, update to version 11.6.6 or later. For GitLab Community and Enterprise Edition versions 11.7.x before 11.7.1, update to version 11.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions 1.3.x through 1.6.x Kubernetes versions 1.7.x through 1.7.13 Kubernetes versions 1.8.x through 1.8.8 Kubernetes versions 1.9.x through 1.9.3 **Description** The issue allows containers using subpath volume mounts to access files and directories outside of the volume, including the host's filesystem, due to a flaw in Kubernetes. This affects containers with any volume type, including non-privileged pods, subject to file permissions. **Recommendations** For Kubernetes versions 1.3.x through 1.6.x, update to version 1.7.14 or later. For Kubernetes versions 1.7.x through 1.7.13, update to version 1.7.14 or later. For Kubernetes versions 1.8.x through 1.8.8, update to version 1.8.9 or later. For Kubernetes versions 1.9.x through 1.9.3, update to version 1.9.4 or later.