CVE-2019-5464 - A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized

Back Back to CVE browser

CRITICAL

A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized

Published Jan 28, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.80%

Description

A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

Affected products

Vendor GitLab Product GitLab CE/EE Default
n/a
- Version
  Affects GitLab CE/EE 10.2 and later
  Status
  affected
  Constraints
  -
- Version
  Fixed in 12.1.2 in 12.0.4 and in 11.11.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

GitLab CE/EE

n/a

Version	Status	Constraints
Affects GitLab CE/EE 10.2 and later	affected	-
Fixed in 12.1.2 in 12.0.4 and in 11.11.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-918

SSRF

References (3)

https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
x_refsource_MISCPatchRelease NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/63959
x_refsource_MISCExploitVendor Advisory
https://hackerone.com/reports/632101
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/		x_refsource_MISCPatchRelease NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/63959		x_refsource_MISCExploitVendor Advisory
https://hackerone.com/reports/632101		x_refsource_MISCPermissions Required