AVG-2335 log

Package gitlab
Status Fixed
Severity Medium
Type multiple issues
Affected 14.2.1-1
Fixed 14.2.2-1
Current 14.10.2-1 [community]
Ticket None
Created Tue Aug 31 18:50:20 2021
Issue Severity Remote Type Description
CVE-2021-22258 Medium Yes Information disclosure
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses.
CVE-2021-22257 Medium Yes Information disclosure
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.2.2. The route for /user.keys is not restricted on instances with...
CVE-2021-22238 Medium Yes Cross-site scripting
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored cross-site scripting (XSS) attack by...
References
https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/
Notes
The advisory contains six more security issues for which a CVE ID has been request, but has not been assigned yet.