JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitlab: 12.5.3 -> 12.5.4

Browse Source 
https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/

Insufficient parameter sanitization for Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. The issue is now mitigated in the latest release and is assigned CVE-2019-19628.

When transferring a public project to a private group, private code would be disclosed via the Group Search API provided by Elasticsearch integration. The issue is now mitigated in the latest release and is assigned CVE-2019-19629.

The Git dependency has been upgraded to 2.22.2 in order to apply security fixes detailed here.

CVE-2019-19604 was identified by the GitLab Security Research team. For more information on that issue, please visit the GitLab Security Research Advisory

closes #75506.
This commit is contained in:
Florian Klink 2019-12-11 15:14:56 +01:00
parent 7e93638ca7
commit 5bf07d665f
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkgs/applications/version-management/gitlab/data.json
View File

@ -1,9 +1,9 @@
{ {
"version": "12.5.3", "version": "12.5.4",
"repo_hash": "1q76yhg4ygs9w5hb8hbv1908d5pfqzr8idmjp06pa4dw5qqqkv97", "repo_hash": "08jngv83pvxjyw3iaqzv484v4mwgwnzg9am3iqfidl9ihbm7i4h2",
"owner": "gitlab-org", "owner": "gitlab-org",
"repo": "gitlab", "repo": "gitlab",
"rev": "v12.5.3-ee", "rev": "v12.5.4-ee",
"passthru": { "passthru": {
"GITALY_SERVER_VERSION": "1.72.1", "GITALY_SERVER_VERSION": "1.72.1",
"GITLAB_PAGES_VERSION": "1.12.0", "GITLAB_PAGES_VERSION": "1.12.0",