[ASA-201807-1] gitlab: multiple issues
Jelle van der Waa
jelle at archlinux.org
Wed Jul 4 11:48:50 UTC 2018
Arch Linux Security Advisory ASA-201807-1
Date : 2018-07-04
CVE-ID : CVE-2018-3740 CVE-2018-12606 CVE-2018-12607
Package : gitlab
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-726
The package gitlab before version 11.0.1-1 is vulnerable to multiple
issues including cross-site scripting and insufficient validation.
Upgrade to 11.0.1-1.
# pacman -Syu "gitlab>=11.0.1-1"
The problems have been fixed upstream in version 11.0.1.
- CVE-2018-3740 (insufficient validation)
A specially crafted HTML fragment can cause Sanitize gem for Ruby to
allow non-whitelisted attributes to be used on a whitelisted HTML
- CVE-2018-12606 (cross-site scripting)
The wiki contains a persistent XSS issue due to a lack of output
encoding affecting a specific markdown feature.
- CVE-2018-12607 (cross-site scripting)
The charts feature contained a persistent XSS issue due to a lack of
An attacker is able to use a GitLab server to execute malicious
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 488 bytes
Desc: not available
More information about the arch-security