PT-2017-12551 · Gitlab · Gitlab Ce/Ee+1

Published 2017-08-14 · Updated 2017-08-25 · CVE-2017-12426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 8.17.8 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.0.x through 9.0.12 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.1.x through 9.1.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.2.x through 9.2.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.3.x through 9.3.9 GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.4.x through 9.4.3

Description The issue might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.

Recommendations For versions prior to 8.17.8, update to version 8.17.8 or later. For versions 9.0.x through 9.0.12, update to version 9.0.13 or later. For versions 9.1.x through 9.1.9, update to version 9.1.10 or later. For versions 9.2.x through 9.2.9, update to version 9.2.10 or later. For versions 9.3.x through 9.3.9, update to version 9.3.10 or later. For versions 9.4.x through 9.4.3, update to version 9.4.4 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12426

Affected Products

Gitlab

Gitlab Ce/Ee

References · 11

• https://ubuntu.com/security/CVE-2017-12426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12426 · Security Note
• https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12426 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12426 · Vendor Advisory
• https://about.gitlab.com/releases/2017/08/10/gitlab-9-dot-4-dot-4-released · Note
• https://mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html · Note
• https://gitlab.com/gitlab-org/gitlab-ce/issues/35212 · Note
• https://mail-archive.com/[e-mail]/msg1466490.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12426 · Note