Log

AVG-1522 created at 01 Feb 2021 22:25:40
Packages
+ gitlab
Issues
+ CVE-2021-22169
Status
+ Not affected
Severity
+ Medium
Affected
+ 13.8.1-1
Fixed
Ticket
Advisory qualified
+ No
References
Notes
+ This security issue only affects Gitlab Enterprise Edition, Arch Linux packages the Community Edition.
AVG-1521 edited at 01 Feb 2021 22:24:54
Issues
- CVE-2021-22169
CVE-2021-22172
CVE-2021-22172 edited at 01 Feb 2021 22:23:58
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page. The issue is fixed in versions 13.8.2, 13.7.6 and 13.6.6.
References
+ https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/#guest-user-can-see-tag-names-in-private-projects
Notes
AVG-1521 edited at 01 Feb 2021 22:22:43
Severity
- Unknown
+ Medium
CVE-2021-22169 edited at 01 Feb 2021 22:22:43
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ An issue was identified in GitLab EE 13.4 or later which could disclose internal IP address via error messages. It is fixed in versions 13.8.2, 13.7.6 and 13.6.6.
References
+ https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/#information-disclosure-via-error-message
Notes
AVG-1521 created at 01 Feb 2021 22:21:23
Packages
+ gitlab
Issues
+ CVE-2021-22169
+ CVE-2021-22172
Status
+ Vulnerable
Severity
+ Unknown
Affected
+ 13.8.1-1
Fixed
Ticket
Advisory qualified
+ Yes
References
+ https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/
Notes
+ There are five more issues in this announcement for which a CVE has been requested, but has not been assigned yet.
CVE-2021-22172 created at 01 Feb 2021 22:21:23
AVG-1521 created at 01 Feb 2021 22:21:23
Packages
+ gitlab
Issues
+ CVE-2021-22169
+ CVE-2021-22172
Status
+ Vulnerable
Severity
+ Unknown
Affected
+ 13.8.1-1
Fixed
Ticket
Advisory qualified
+ Yes
References
+ https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/
Notes
+ There are five more issues in this announcement for which a CVE has been requested, but has not been assigned yet.
CVE-2021-22169 created at 01 Feb 2021 22:21:23
AVG-1518 edited at 01 Feb 2021 20:05:38
Status
- Vulnerable
+ Fixed
Fixed
+ 3.1.6-1
CVE-2021-21287 edited at 01 Feb 2021 19:22:01
Remote
- Unknown
+ Remote
AVG-1520 edited at 01 Feb 2021 19:21:54
Severity
- Unknown
+ Medium
CVE-2021-21287 edited at 01 Feb 2021 19:21:54
Severity
- Unknown
+ Medium
Type
- Unknown
+ Directory traversal
Description
+ In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.). In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed. This is fixed in version RELEASE.2021-01-30T00-20-58Z, all users are advised to upgrade. As a workaround you can disable the browser front-end with the "MINIO_BROWSER=off" environment variable.
References
+ https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q
+ https://github.com/minio/minio/pull/11337
+ https://github.com/minio/minio/commit/eb6871ecd960d570f70698877209e6db181bf276
Notes
+ Workaround
+ ==========
+
+ As a workaround you can disable the browser front-end with the "MINIO_BROWSER=off" environment variable.
AVG-1520 created at 01 Feb 2021 19:19:00
Packages
+ minio
Issues
+ CVE-2021-21287
Status
+ Vulnerable
Severity
+ Unknown
Affected
+ 2020.12.26-1
Fixed
Ticket
Advisory qualified
+ Yes
References
Notes
CVE-2021-21287 created at 01 Feb 2021 19:19:00