FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

gitlab -- Directory traversal via "import/export" feature

Affected packages
8.10.0	<=	gitlab	<=	8.10.12
8.11.0	<=	gitlab	<=	8.11.9
8.12.0	<=	gitlab	<=	8.12.7
8.13.0	<=	gitlab	<=	8.13.2

Details

VuXML ID	10968dfd-a687-11e6-b2d3-60a44ce6887b
Discovery	2016-11-02
Entry	2016-11-09
Modified	2017-05-18

GitLab reports:

The import/export feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users.

[source]

References

CVE Name	CVE-2016-9086
FreeBSD PR	ports/214360
URL	https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/