SB2019041728 - Multiple vulnerabilities in GitLab, Gitlab Community Edition

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-9485)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

2) Input validation error (CVE-ID: CVE-2019-9890)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

Remediation

Install update from vendor's website.

References

• https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/
• https://about.gitlab.com/blog/categories/releases/