CVE-2019-19629

Name of the Vulnerable Software and Affected Versions GitLab EE versions 10.5 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8

Description The issue allows private code to be disclosed via the Group Search API provided by the Elasticsearch integration when transferring a public project to a private group.

Recommendations For GitLab EE versions 10.5 through 12.5.3, consider restricting access to the Group Search API until a fix is available. For GitLab EE version 12.4.5, restrict the use of the Elasticsearch integration for private groups. For GitLab EE version 12.3.8, avoid using the Group Search API for sensitive projects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.