FreeBSD : Gitlab -- multiple vulnerabilities (dc0c201c-31da-11e8-ac53-d8cb8abf62dd)

Medium Nessus Plugin ID 108704

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

GitLab reports : SSRF in services and web hooks There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potentially code execution. This issue has been assigned CVE-2018-8801. Gitlab Auth0 integration issue There was an issue with the GitLab omniauth-auth0 configuration which resulted in the Auth0 integration signing in the wrong users.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?ec048c91

http://www.nessus.org/u?3ee4bab5

Plugin Details

Severity: Medium

ID: 108704

File Name: freebsd_pkg_dc0c201c31da11e8ac53d8cb8abf62dd.nasl

Version: 1.5

Type: local

Published: 2018/03/29

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS v3.0

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:gitlab, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2018/03/27

Vulnerability Publication Date: 2018/03/20

Reference Information

CVE: CVE-2018-8801