CVE-2018-19572 - GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment

Back Back to CVE browser

MEDIUM

GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment

Published Jul 10, 2019

5.9

MEDIUM

CVSS 3.0

EPSS 0.92%

Description

GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (3)

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11261
Advisory
https://gitlab.com/gitlab-org/gitlab-pages/issues/98
x_refsource_MISCIssue TrackingVendor Advisory

Link	Providers	Tags
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/		x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11261		Advisory
https://gitlab.com/gitlab-org/gitlab-pages/issues/98		x_refsource_MISCIssue TrackingVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 10, 2019

Updated Aug 5, 2024

Reserved Nov 26, 2018

Link CVE-2018-19572

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-19572

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jul 10, 2019

Updated Aug 5, 2024

Link EUVD-2018-11261

GitHub

No data