-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3315
          Multiple vulnerabilities have been identified in Gitlab
                             2 September 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Gitlab
Publisher:         FreeBSD
Operating System:  UNIX variants (UNIX, Linux, OSX)
                   Virtualisation
Impact/Access:     Increased Privileges     -- Unknown/Unspecified   
                   Cross-site Scripting     -- Existing Account      
                   Denial of Service        -- Unknown/Unspecified   
                   Unauthorised Access      -- Remote/Unauthenticated
                   Access Confidential Data -- Unknown/Unspecified   
                   Reduced Security         -- Unknown/Unspecified   
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-15741 CVE-2019-15740 CVE-2019-15739
                   CVE-2019-15738 CVE-2019-15737 CVE-2019-15736
                   CVE-2019-15734 CVE-2019-15733 CVE-2019-15732
                   CVE-2019-15731 CVE-2019-15730 CVE-2019-15729
                   CVE-2019-15728 CVE-2019-15727 CVE-2019-15726
                   CVE-2019-15725 CVE-2019-15724 CVE-2019-15723
                   CVE-2019-15722 CVE-2019-15721 

Original Bulletin: 
   http://www.vuxml.org/freebsd/b68cc195-cae7-11e9-86e9-001b217b3468.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Gitlab -- Multiple Vulnerabilities

Affected packages
12.2.0	<=	gitlab-ce	<	12.2.3
12.1.0	<=	gitlab-ce	<	12.1.8
0.0.0	<=	gitlab-ce	<	12.0.8

Details

VuXML ID	b68cc195-cae7-11e9-86e9-001b217b3468
Discovery	2019-08-29
Entry	2019-08-30
Gitlab reports:

Kubernetes Integration Server-Side Request Forgery

Server-Side Request Forgery in Jira Integration

Improved Protection Against Credential Stuffing Attacks

Markdown Clientside Resource Exhaustion

Pipeline Status Disclosure

Group Runner Authorization Issue

CI Metrics Disclosure

User IP Disclosed by Embedded Image and Media

Label Description HTML Injection

IDOR in Epic Notes API

Push Rule Bypass

Project Visibility Restriction Bypass

Merge Request Discussion Restriction Bypass

Disclosure of Merge Request IDs

Weak Authentication In Certain Account Actions

Disclosure of Commit Title and Comments

Stored XSS via Markdown

EXIF Geolocation Data Exposure

Multiple SSRF Regressions on Gitaly

Default Branch Name Exposure

Potential Denial of Service via CI Pipelines

Privilege Escalation via Logrotate

[source]
References
CVE Name	CVE-2019-15721
CVE Name	CVE-2019-15722
CVE Name	CVE-2019-15723
CVE Name	CVE-2019-15724
CVE Name	CVE-2019-15725
CVE Name	CVE-2019-15726
CVE Name	CVE-2019-15727
CVE Name	CVE-2019-15728
CVE Name	CVE-2019-15729
CVE Name	CVE-2019-15730
CVE Name	CVE-2019-15731
CVE Name	CVE-2019-15732
CVE Name	CVE-2019-15733
CVE Name	CVE-2019-15734
CVE Name	CVE-2019-15736
CVE Name	CVE-2019-15737
CVE Name	CVE-2019-15738
CVE Name	CVE-2019-15739
CVE Name	CVE-2019-15740
CVE Name	CVE-2019-15741

URL	https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXWxp0maOgq3Tt24GAQgBFxAAizBr28iB8Gy6leDTrVGH3TvnQR5a3dqj
t7AIMFH1595YonAIMwbJ08RXONlab9Rve2oMrR/JROTC/IAQq4Zx9gpObure/+Eh
dvl50lxSBPQPEjQxqi6FzrT4hcIMtnFKBKyx4w9fDg3ojQtucx7OvKvB5RUCOFTL
9ijJ+4+2WaFJYtfj3agOzub6iSCe00zHCtRz+kHqSjejnP93T7nlXqzgSCkWTosa
HzyFfqITdIkDKJ1KYqWc6PUx+Jx01L2S8H9eHcLsIWuaDFf14IFkyRQWbbNVRCHc
j/78+kAzZPL0EORVfpM5VjpeDoh68eloimUrvfJqIiYIa+N4dQnSx4GUizNlNcQY
zy1HvSfv6RrGJK2Zm9ynqtrOIWLTO+XMfNNEoEu+hD+rnd8YfkOtOArr9ETZ7Dlo
imNZRWTtTUdUr7lOBcWAIMZGEldc5+JnvH9zAoNSJtcLzSG+xt2SGE0j+/lYyZXv
tV9ad03hfZ2rCvoFW/W8oSorPWeSg3AaKarvZIK6Ujxlkll37wR0a7vcQWCr0DOY
HZwb09KLWE/IadiA+rFkhbxVN2O8TzwKQc+K1z9+KfcCOPuFZV1nR4vU1JSIxblt
nDkCRN82ebH66MIL+HgoSlVkx34zjIOqR4nZ+wiJ4G/kt+QvcYUqpBeNAYFeeg4L
rG3VAbQvZJs=
=O8wa
-----END PGP SIGNATURE-----