gitlab: CVE-2017-12426: Remote Command Execution in git client

Debian Bug report logs - #872190
gitlab: CVE-2017-12426: Remote Command Execution in git client

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gitlab: CVE-2017-12426: Remote Command Execution in git client

Date: Tue, 15 Aug 2017 07:40:59 +0200

Source: gitlab
Version: 8.13.11+dfsg1-8
Severity: grave
Tags: security upstream
Forwarded: https://gitlab.com/gitlab-org/gitlab-ce/issues/35212

Hi,

the following vulnerability was published for gitlab.

CVE-2017-12426[0]:
| GitLab Community Edition (CE) and Enterprise Edition (EE) before
| 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10,
| 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote
| attackers to execute arbitrary code via a crafted SSH URL in a project
| import.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12426
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12426
[1] https://gitlab.com/gitlab-org/gitlab-ce/issues/35212
[2] https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/

Regards,
Salvatore

Message #10 received at 872190@bugs.debian.org (full text, mbox, reply):

From: Pirate Praveen <praveen@debian.org>

To: 872190@bugs.debian.org

Subject: Re: gitlab: CVE-2017-12426: Remote Command Execution in git client

Date: Thu, 17 Aug 2017 18:24:43 +0530

[Message part 1 (text/plain, inline)]

On Tue, 15 Aug 2017 07:40:59 +0200 Salvatore Bonaccorso
<carnil@debian.org> wrote:> If you fix the vulnerability please also
make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

This is already fixed in git 1:2.11.0-3+deb9u1. The patch in gitlab is
extra step to prevent in case of a vulnerable git. Since debian already
has the fixed version of git, I don't think we need to do anything to
gitlab.

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 872190@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Pirate Praveen <praveen@debian.org>, 872190@bugs.debian.org

Subject: Re: Bug#872190: gitlab: CVE-2017-12426: Remote Command Execution in git client

Date: Thu, 17 Aug 2017 19:16:38 +0200

Control: severity -1 minor

On Thu, Aug 17, 2017 at 06:24:43PM +0530, Pirate Praveen wrote:
> On Tue, 15 Aug 2017 07:40:59 +0200 Salvatore Bonaccorso
> <carnil@debian.org> wrote:> If you fix the vulnerability please also
> make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> This is already fixed in git 1:2.11.0-3+deb9u1. The patch in gitlab is
> extra step to prevent in case of a vulnerable git. Since debian already
> has the fixed version of git, I don't think we need to do anything to
> gitlab.

Agree, we can at least lower the severity and thanks a lot for the
followup. The CVE seem to be specific assigned for the "via a crafted
SSH URL in a project import". Can you close this bug once the gitlab
version contains as well this extra safety measure if still running
with older git?

For the security tracker I have already downgraded the severity to
unimportant.

Regards,
Salvatore

Message #22 received at 872190@bugs.debian.org (full text, mbox, reply):

From: Pirate Praveen <praveen@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 872190@bugs.debian.org

Subject: Re: Bug#872190: gitlab: CVE-2017-12426: Remote Command Execution in git client

Date: Thu, 17 Aug 2017 23:25:42 +0530

[Message part 1 (text/plain, inline)]

On വ്യാഴം 17 ആഗസ്റ്റ് 2017 10:46 വൈകു, Salvatore Bonaccorso wrote:
> Agree, we can at least lower the severity and thanks a lot for the
> followup. The CVE seem to be specific assigned for the "via a crafted
> SSH URL in a project import". Can you close this bug once the gitlab
> version contains as well this extra safety measure if still running
> with older git?
yes.
> For the security tracker I have already downgraded the severity to
> unimportant.

thanks.

[signature.asc (application/pgp-signature, attachment)]

Message #29 received at 872190-done@bugs.debian.org (full text, mbox, reply):

From: Pirate Praveen <praveen@onenetbeyond.org>

To: 872190-done@bugs.debian.org

Subject: Re: Bug#872190: gitlab: CVE-2017-12426: Remote Command Execution in git client

Date: Sun, 18 Nov 2018 08:46:33 +0530

[Message part 1 (text/plain, inline)]

On Thu, 17 Aug 2017 19:16:38 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
> Can you close this bug once the gitlab
> version contains as well this extra safety measure if still running
> with older git?

We have 10.8.7 in buster and 11.1.8 in sid. Closing.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.