PT-2020-12652 · Microsoft+1 · Nuget+2

Vakzz · Published 2020-04-22 · Updated 2024-03-06 · CVE-2020-11505

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community Edition (CE) versions 12.7.x through 12.7.8 GitLab Community Edition (CE) versions 12.8.x through 12.8.8 GitLab Community Edition (CE) versions 12.9.x through 12.9.2 GitLab Enterprise Edition (EE) versions 12.7.x through 12.7.8 GitLab Enterprise Edition (EE) versions 12.8.x through 12.8.8 GitLab Enterprise Edition (EE) versions 12.9.x through 12.9.2

Description An issue in GitLab could lead to the exposure of sensitive information via request smuggling, potentially allowing NuGet package and file disclosure.

Recommendations For GitLab Community Edition (CE) versions 12.7.x through 12.7.8, update to version 12.7.9 or later. For GitLab Community Edition (CE) versions 12.8.x through 12.8.8, update to version 12.8.9 or later. For GitLab Community Edition (CE) versions 12.9.x through 12.9.2, update to version 12.9.3 or later. For GitLab Enterprise Edition (EE) versions 12.7.x through 12.7.8, update to version 12.7.9 or later. For GitLab Enterprise Edition (EE) versions 12.8.x through 12.8.8, update to version 12.8.9 or later. For GitLab Enterprise Edition (EE) versions 12.9.x through 12.9.2, update to version 12.9.3 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BIT-GITLAB-2020-11505

CVE-2020-11505

Affected Products

Gitlab

Gitlab Ce/Ee

Nuget

References · 5

• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11505 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2020-11505 · Vendor Advisory