PT-2020-11134
CVE-2019-5464
·
Published
2020-01-28
·
Updated
2020-01-31
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GitLab CE/EE versions 10.2 and later
Description
A flawed DNS rebinding protection issue was discovered in the
url blocker.rb library, which could result in Server-Side Request Forgery (SSRF) where the library is utilized.Recommendations
For GitLab CE/EE versions 10.2 and later, consider restricting access to the
url blocker.rb library until a patch is available. As a temporary workaround, review and limit the usage of the library to minimize the risk of SSRF exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾