[Git][security-tracker-team/security-tracker][master] Add references for gitlab which should hopefully help tracking fix

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
74c8c5eb by Salvatore Bonaccorso at 2019-12-20T19:55:41Z
Add references for gitlab which should hopefully help tracking fix

There was no gitlab advisory for those issues yet (possibly scheduled
for 2019-12-22?). In case this is not true the added references should
help further track the fixed versions.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -18971,10 +18971,12 @@ CVE-2019-15592
        RESERVED
 CVE-2019-15591 (An improper access control vulnerability exists in GitLab 
<12.3.3 t ...)
        - gitlab <unfixed>
+       NOTE: https://hackerone.com/reports/676976
 CVE-2019-15590
        RESERVED
 CVE-2019-15589 (An improper access control vulnerability exists in Gitlab 
&lt;v12.3.2, ...)
        - gitlab <unfixed>
+       NOTE: https://hackerone.com/reports/497047
 CVE-2019-15588 (There is an OS Command Injection in Nexus Repository Manager 
&lt;= 2.1 ...)
        NOT-FOR-US: Nexus Repository Manager
 CVE-2019-15587 (In the Loofah gem for Ruby through v2.3.0 unsanitized 
JavaScript may o ...)
@@ -19001,10 +19003,13 @@ CVE-2019-15578
        RESERVED
 CVE-2019-15577 (An information disclosure vulnerability exists in GitLab CE/EE 
&lt;v12 ...)
        - gitlab <unfixed>
+       NOTE: https://hackerone.com/reports/636560
 CVE-2019-15576 (An information disclosure vulnerability exists in GitLab CE/EE 
&lt;v12 ...)
        - gitlab <unfixed>
+       NOTE: https://hackerone.com/reports/633001
 CVE-2019-15575 (A command injection exists in GitLab CE/EE &lt;v12.3.2, 
&lt;v12.2.6, a ...)
        - gitlab <unfixed>
+       NOTE: https://hackerone.com/reports/682442
 CVE-2019-15574 (Gesior-AAC before 2019-05-01 allows serviceID SQL injection in 
account ...)
        NOT-FOR-US: Gesior-AAC
 CVE-2019-15573 (Gesior-AAC before 2019-05-01 allows SQL injection in 
tankyou.php. ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/74c8c5ebacce2e6193f3a51430e2ed583a08d240

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/74c8c5ebacce2e6193f3a51430e2ed583a08d240
You're receiving this email because of your account on salsa.debian.org.



_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits