security/vuxml: document gitlab vulnerabilities

freebsd · Feb 8, 2024 · 90fd8b9 · 90fd8b9
1 parent 2aacaa5
commit 90fd8b9
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
@@ -1,3 +1,37 @@
+  <vuln vid="6b2cba6a-c6a5-11ee-97d0-001b217b3468">
+    <topic>Gitlab -- vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>gitlab-ce</name>
+	<range><ge>16.8.0</ge><lt>16.8.2</lt></range>
+	<range><ge>16.7.0</ge><lt>16.7.5</lt></range>
+	<range><ge>13.3.0</ge><lt>16.6.7</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Gitlab reports:</p>
+	<blockquote cite="https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/">
+	  <p>Restrict group access token creation for custom roles</p>
+	  <p>Project maintainers can bypass group's scan result policy block_branch_modification setting</p>
+	  <p>ReDoS in CI/CD Pipeline Editor while verifying Pipeline syntax</p>
+	  <p>Resource exhaustion using GraphQL vulnerabilitiesCountByDay</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2024-1250</cvename>
+      <cvename>CVE-2023-6840</cvename>
+      <cvename>CVE-2023-6386</cvename>
+      <cvename>CVE-2024-1066</cvename>
+      <url>https://about.gitlab.com/releases/2024/02/07/security-release-gitlab-16-8-2-released/</url>
+    </references>
+    <dates>
+      <discovery>2024-02-07</discovery>
+      <entry>2024-02-08</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="33ba2241-c68e-11ee-9ef3-001999f8d30b">
     <topic>Composer -- Code execution and possible privilege escalation</topic>
     <affects>