CVEvulnerability
CVE-2019-10112
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-05-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-326
Description
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.
Affected configurations
• gitlab gitlab (< 11.7.8)
• gitlab gitlab (>= 11.8.0 < 11.8.4)
• gitlab gitlab (>= 11.9.0 < 11.9.2)
Related
Weakness · CWE (1)
- CWE-326 Inadequate Encryption Strength weakness
References
- https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/ Release Notes, Vendor Advisory
- https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ee/issues/9730 Exploit, Third Party Advisory
- https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/ Release Notes, Vendor Advisory
- https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ee/issues/9730 Exploit, Third Party Advisory