AVG-2335 log
| Package | gitlab |
| Status | Fixed |
| Severity | Medium |
| Type | multiple issues |
| Affected | 14.2.1-1 |
| Fixed | 14.2.2-1 |
| Current | 17.5.2-1 [extra] |
| Ticket | None |
| Created | Tue Aug 31 18:50:20 2021 |
| Issue | Severity | Remote | Type | Description |
|---|---|---|---|---|
| CVE-2021-22258 | Medium | Yes | Information disclosure | The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses. |
| CVE-2021-22257 | Medium | Yes | Information disclosure | An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.2.2. The route for /user.keys is not restricted on instances with... |
| CVE-2021-22238 | Medium | Yes | Cross-site scripting | An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored cross-site scripting (XSS) attack by... |
| References |
|---|
https://about.gitlab.com/releases/2021/08/31/security-release-gitlab-14-2-2-released/ |
| Notes |
|---|
The advisory contains six more security issues for which a CVE ID has been request, but has not been assigned yet. |