BSD PortsGitlab -- Vulnerabilities
· CVE-2025-0475, CVE-2025-0555, CVE-2024-8186, CVE-2024-10925, CVE-2025-0307 · VuXML entry
Gitlab reports: XSS in k8s proxy endpoint XSS Maven Dependency Proxy HTML injection leads to XSS on self hosted instances Improper Authorisation Check Allows Guest User to Read Security Policy Planner role can read code review analytics in private projects
Affected versions
- gitlab-ce, gitlab-ee >= 17.9.0 < 17.9.1; >= 17.8.0 < 17.8.4; >= 15.10.0 < 17.7.6
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | www/gitlab | 19.5.1_2 | fixed | (531 days after) |
| MidnightBSD | www/gitlab | ${GITLAB_VERSION}_${GITLAB_PORTREVISION} | out of range, by version |