{"id":9775,"date":"2019-12-24T01:27:14","date_gmt":"2019-12-24T01:27:14","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9775"},"modified":"2026-04-17T18:07:50","modified_gmt":"2026-04-17T18:07:50","slug":"advisory-gitlab-ee-multiple-high-risk-vulnerabilities","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/advisory-gitlab-ee-multiple-high-risk-vulnerabilities\/","title":{"rendered":"Advisory: Gitlab EE multiple high-risk vulnerabilities"},"content":{"rendered":"


\n<\/p>\n

Vulnerability Description<\/strong><\/h2>\n

On December 10, 2019 local time, GitLab officially released an important version update notice, announcing three high-risk vulnerabilities in GitLab EE (Enterprise Edition). GitLab is an open source and web-based Git-repository management project.<\/p>\n

CVE-2019-19628: Because the registry of the maven package does not have accurate parameter settings, an attacker can achieve privilege escalation and remote code execution under certain conditions.<\/p>\n

CVE-2019-19629: When importing public projects into private groups, the Group Search API integrated on Elasticsearch may cause leakage of private codes.<\/p>\n

CVE-2019-19604: When users use the Git submodule update function, an attacker can use this vulnerability to execute arbitrary commands defined in the .gitmodules file.<\/p>\n

Reference:<\/p>\n

https:\/\/gitlab.com\/gitlab-com\/gl-security\/disclosures\/blob\/master\/003_git_submodule\/advisory.md<\/a><\/p>\n

https:\/\/about.gitlab.com\/blog\/2019\/12\/10\/critical-security-release-gitlab-12-5-4-released\/<\/a><\/p>\n

 <\/p>\n

Scope of Impact<\/strong><\/h2>\n

CVE-2019-19628：<\/p>\n

Affected Versions<\/strong><\/p>\n