CVE-2017-0925

NameCVE-2017-0925
DescriptionGitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4145-1
NVD severitymedium (attack range: remote)
Debian Bugs888508

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gitlab (PTS)sid11.8.10+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gitlabsource(unstable)10.5.5+dfsg-1medium888508
gitlabsourcestretch8.13.11+dfsg1-8+deb9u1mediumDSA-4145-1

Notes

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/

Search for package or bug name: Reporting problems