ArchLinux: 202104-1: gitlab: multiple issues | LinuxSecurity.com
Arch Linux Security Advisory ASA-202104-1
=========================================

Severity: Critical
Date    : 2021-04-29
CVE-ID  : CVE-2021-22205 CVE-2021-28965
Package : gitlab
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1822

Summary
=======

The package gitlab before version 13.10.3-1 is vulnerable to multiple
issues including arbitrary code execution and incorrect calculation.

Resolution
==========

Upgrade to 13.10.3-1.

# pacman -Syu "gitlab>=13.10.3-1"

The problems have been fixed upstream in version 13.10.3.

Workaround
==========

None.

Description
===========

- CVE-2021-22205 (arbitrary code execution)

An issue has been discovered in GitLab CE/EE affecting all versions
starting from 11.9. GitLab was not properly validating image files that
is passed to a file parser which resulted in a remote command
execution. The issue is fixed in GitLab versions 13.10.3, 13.9.6 and
13.8.8.

- CVE-2021-28965 (incorrect calculation)

When parsing and serializing a crafted XML document, the REXML gem
(including the one bundled with Ruby) can create a wrong XML document
whose structure is different from the original one. The impact of this
issue highly depends on context, but it may lead to a vulnerability in
some programs that are using REXML. The issue is fixed in version 3.2.5
of the REXML gem.

Impact
======

An attacker can crash or execute arbitrary code on the affected server
by providing a maliciously crafted XML or image file.

References
==========

https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/
https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/#Remote-code-execution-when-uploading-specially-crafted-image-files
https://gitlab.com/gitlab-org/gitlab/-/issues/327121
https://hackerone.com/reports/1154542
https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
https://hackerone.com/reports/1104077
https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8
https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b
https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752
https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551
https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618
https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e
https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377
https://security.archlinux.org/CVE-2021-22205
https://security.archlinux.org/CVE-2021-28965

ArchLinux: 202104-1: gitlab: multiple issues

April 29, 2021
The package gitlab before version 13.10.3-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation

Summary

- CVE-2021-22205 (arbitrary code execution)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that is passed to a file parser which resulted in a remote command execution. The issue is fixed in GitLab versions 13.10.3, 13.9.6 and 13.8.8.
- CVE-2021-28965 (incorrect calculation)
When parsing and serializing a crafted XML document, the REXML gem (including the one bundled with Ruby) can create a wrong XML document whose structure is different from the original one. The impact of this issue highly depends on context, but it may lead to a vulnerability in some programs that are using REXML. The issue is fixed in version 3.2.5 of the REXML gem.

Resolution

Upgrade to 13.10.3-1.
# pacman -Syu "gitlab>=13.10.3-1"
The problems have been fixed upstream in version 13.10.3.

References

https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/ https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/#Remote-code-execution-when-uploading-specially-crafted-image-files https://gitlab.com/gitlab-org/gitlab/-/issues/327121 https://hackerone.com/reports/1154542 https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/ https://hackerone.com/reports/1104077 https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8 https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752 https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551 https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618 https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377 https://security.archlinux.org/CVE-2021-22205 https://security.archlinux.org/CVE-2021-28965

Severity
CVE-ID : CVE-2021-22205 CVE-2021-28965
Package : gitlab
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1822

Impact

An attacker can crash or execute arbitrary code on the affected server by providing a maliciously crafted XML or image file.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.