From 5bf07d665f0b1f14c6ab8f8fba069dfb1bf1c3d1 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 11 Dec 2019 15:14:56 +0100 Subject: [PATCH] gitlab: 12.5.3 -> 12.5.4 https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/ Insufficient parameter sanitization for Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. The issue is now mitigated in the latest release and is assigned CVE-2019-19628. When transferring a public project to a private group, private code would be disclosed via the Group Search API provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned CVE-2019-19629. The Git dependency has been upgraded to 2.22.2 in order to apply security fixes detailed here. CVE-2019-19604 was identified by the GitLab Security Research team. For more information on that issue, please visit the GitLab Security Research Advisory closes #75506. --- pkgs/applications/version-management/gitlab/data.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json index ceea2f44a8b..ed8debb404d 100644 --- a/pkgs/applications/version-management/gitlab/data.json +++ b/pkgs/applications/version-management/gitlab/data.json @@ -1,9 +1,9 @@ { - "version": "12.5.3", - "repo_hash": "1q76yhg4ygs9w5hb8hbv1908d5pfqzr8idmjp06pa4dw5qqqkv97", + "version": "12.5.4", + "repo_hash": "08jngv83pvxjyw3iaqzv484v4mwgwnzg9am3iqfidl9ihbm7i4h2", "owner": "gitlab-org", "repo": "gitlab", - "rev": "v12.5.3-ee", + "rev": "v12.5.4-ee", "passthru": { "GITALY_SERVER_VERSION": "1.72.1", "GITLAB_PAGES_VERSION": "1.12.0",